Mastercard 3DS Mandatory Fields: What Merchants Must Send Before 1 July 2026

Visa mandated a set of enhanced data fields for 3DS authentication back in August 2024. Mastercard has now aligned, updating its own requirements on 1 April 2026 under its Mastercard Identity Check programme. The fields that both schemes require were always part of the 3DS 2.x specification. They were optional. They are not anymore.

If you are already sending these fields, nothing changes. If not, you should start sending them ahead of the July 2026 milestone, as Mastercard and issuers will increasingly rely on this data and missing fields could negatively impact authentication outcomes.

What Is Actually Required

Both schemes have aligned on the same set of EMV 3DS 2.2 cardholder data fields. The requirement splits into three categories.

Cardholder Information

Cardholder name is mandatory. Email address or mobile phone number: at least one, preferably both.

Address Data

Billing address line 1 is mandatory. Billing city, country, postal code, and state are required where you have them. Shipping address line 1 is required when you are shipping physical goods.

Device and Technical Data

IP address or device ID: you must send at least one. Browser screen height and width, language, and time zone are required where available. The practical rule is: if you collect it, send it.

On Device ID Specifically

Device ID sounds more complex than it is. Both Visa and Mastercard specify that merchants must send at least one of IP address or device ID. IP address is captured in virtually every standard checkout flow already. You do not need to implement device fingerprinting to meet this requirement. Most merchants can tick this box today without any development work.

The Timeline

Visa moved first. Its 3DS authentication data requirements became mandatory in August 2024. Mastercard updated its own 3DS data requirements on 1 April 2026, broadly aligning with the same fields Visa had already introduced.

If you addressed the Visa requirements when they landed in 2024, you are likely already compliant for Mastercard too. If you did not, both now apply.

Why the Schemes Are Doing This

The data behind this mandate is consistent. Card-not-present transactions submitted with richer authentication data produce better outcomes across every metric: Visa's own analysis shows a 4 to 6% improvement in authentication success rates. Your 3DS frictionless rate goes up, meaning fewer cardholders hit a challenge step at checkout. Fraud detection improves because issuers have more signals to work with.

Issuers make frictionless decisions based on confidence. The more data they receive, the more confidently they can approve without interrupting the cardholder. When data is missing, the default is caution.

What to Do

Audit what you are currently sending in your 3DS authentication requests. Your payment gateway, orchestrator, acquirer or standalone 3DS provider should be able to show you which fields are present and which are absent.

In many cases the data already exists in your systems but is not being passed through to the authentication request. Billing postcode and email address are the most common examples.

Cardholder name and billing address line 1 are the mandatory fields to confirm first. Start there before working through the conditional fields.

Once you have made changes, verify them. Your partner should be able to confirm that your 3DS requests are sending the required data elements correctly.

Documentation and Field Reference

The EMVCo 3DS specification is the authoritative reference for field formats and implementation detail:

EMVCo 3DS Specification

For the full list of required and strongly recommended fields, including exact parameter names and technical specifications, see the Mandatory Data for 3DS Processing section in the PCI Proxy API documentation:

PCI Proxy 3D Secure API

Ready for the Mastercard 3DS Deadline?

If you are not sure whether your current integration covers everything, our team can help you check. Reach out and we will take a look together

‍