Dynamic Data Collection in threedsmax: Reduce Friction, Boost Fraud Detection

Why Dynamic Data Collection Matters

When a merchant uses 3DS2, the authentication step can interrupt the checkout flow if the ACS (Access Control Server) requires user interaction. Dynamic data collection lets the ACS decide whether to prompt the card‑holder or complete the transaction silently, based on real‑time device and browser information. The result is a smoother checkout for customers and a richer data set for fraud teams.

What the threedsmax Library Provides

The threedsmax client includes a lightweight DynamicDataCollector that automatically gathers the fields required by the 3DS2 specification. It serialises the data into a data object inside the AuthRequest payload, so developers do not need to hand‑craft JSON or maintain a mapping of device attributes.

Key Points

• Feature is only available for 3DS2 flows.
• Enabling it is a single flag plus an HTTP interceptor.
• Thread‑safe and stateless – suitable for microservices.
• Payload size increases; monitor gateway limits.
• Privacy‑aware: optional fields can be disabled if regulations apply.

Enabling Dynamic Data Collection

Below is a minimal Java example that shows how to turn on the feature in a typical Spring Boot application that uses threedsmax.

// 1. Add the library to your build
// Maven
<dependency>
  <groupId>com.example.threedsmax</groupId>
  <artifactId>threedsmax-client</artifactId>
  <version>2.3.1</version>
</dependency>

// 2. Configure the client
@Bean
public ThreedsmaxClient threedsmaxClient() {
    ThreedsmaxConfig cfg = new ThreedsmaxConfig();
    cfg.setMerchantId("your-merchant-id");
    cfg.setApiKey("your-api-key");
    cfg.setEnableDynamicData(true); // Enable the feature
    return new ThreedsmaxClient(cfg);
}

// 3. Add the interceptor to your HTTP client
@Bean
public ClientHttpRequestInterceptor dynamicInterceptor(ThreedsmaxClient client) {
    return new DynamicDataInterceptor(client.getDynamicDataCollector());
}

When the DynamicDataInterceptor is attached to the HTTP client that sends the AuthRequest, the collector automatically captures:

• Device type, OS, and app version.
• Browser user‑agent and language.
• Geolocation (if permitted).
• Device fingerprint hashes.

Concrete Example: AuthRequest Payload

Below is a typical AuthRequest that includes the data object. The example uses placeholder values; replace them with your real transaction data.

{
  "merchantId": "your-merchant-id",
  "transactionId": "txn-12345",
  "amount": {
    "value": 1000,
    "currency": "USD"
  },
  "data": {
    "deviceData": {
      "deviceType": "mobile",
      "osVersion": "Android 13",
      "appVersion": "2.5.0"
    },
    "browserData": {
      "userAgent": "Mozilla/5.0…",
      "language": "en-US"
    },
    "geoData": {
      "latitude": 37.4220,
      "longitude": -122.0841
    },
    "fingerprint": "a1b2c3d4e5"
  }
}

When this request reaches the payment gateway, the ACS can instantly decide whether the transaction is low risk and skip the user prompt, or it can trigger a challenge if the data suggests higher risk.

Trade‑Offs and Limitations

Payload Size and Bandwidth

Dynamic data adds roughly 200–500 bytes per request, depending on optional fields. On mobile networks, this extra payload can increase latency. If your application serves a large number of low‑bandwidth users, consider disabling the feature for those connections.

Gateway Compatibility

Not all gateways support 3DS2 or dynamic data collection. Enabling the flag against a 3DS1‑only gateway will cause the transaction to fail. Verify your gateway’s capabilities before deployment.

Privacy and Compliance

Some jurisdictions restrict the collection of geolocation or device fingerprint data. The DynamicDataCollector exposes configuration flags to exclude specific fields. Adjust the collector settings to stay compliant with GDPR, CCPA, or local regulations.

Monitoring and Alerting

After enabling the feature, monitor:

• AuthRequest payload size against gateway limits.
• Transaction success rates and latency.
• ACS response codes to confirm silent authentication is occurring.

Verification Checklist

1. Enable the dynamic data flag and send a test AuthRequest to a 3DS2‑enabled test server.
2. Capture the outbound request with a proxy (e.g., Wireshark, mitmproxy) and confirm the data object is present.
3. Check the ACS response for a silent authentication code (e.g., authenticationSuccessful without challenge).
4. In staging, compare latency and success rates before and after enabling the feature.

Actionable Next Steps

• Confirm your gateway supports 3DS2 and dynamic data collection.
• Add the enableDynamicData flag and interceptor as shown.
• Run the verification checklist in a test environment.
• Deploy to staging, monitor payload size and latency.
• Roll out to production once confidence thresholds are met.

Dynamic data collection is a low‑overhead, high‑impact feature that can make the checkout experience frictionless while giving fraud teams richer context. With the steps above, you can evaluate the trade‑offs and decide when to enable it for your merchants.