Carsten Muerl Director Product Management Mastercard Carsten Muerl is responsible for security solutions such as authentication, 3-D Secure or fraud detection in the Cyber & Intelligence Solutions business unit of Mastercard (Germany and Switzerland). He has more than 20 years experience in the payment industry. As Head of Product Management of Cards at Deutsche Bank he was responsible among others for new card programs like Debit Mastercard and the introduction of new features like CardApp or mobile payment. He studied Business Informatics at Karlsruhe University of Applied Sciences.

2. Getting ready for
PSD2 on time!
How Zalando and Mastercard
implemented Strong Customer
Authentication (SCA)
Berlin, 13th February 2020

3. ©2019Mastercard.ProprietaryandConfidential.
This document contains the proprietary and confidential information of Mastercard Europe SA (“Mastercard”) and the information provided herein is strictly
confidential. It is intended to be used internally within your organization and by receiving this information, you agree that that except with the prior written
permission of Mastercard, such information shall not be used for any unauthorized purpose and shall not be published or disclosed to third parties, in whole or
part.
Information in this presentation or in any report or deliverable provided by Mastercard in connection herewith relating to the projected impact on your financial
performance, as well as the results that you may expect generally are estimates only. No assurances are given that any of these projections, estimates, or
expectations will be achieved, or that the analysis provided is error-free. You acknowledge and agree that inaccuracies and inconsistencies may be inherent in
both Mastercard’s and your data and systems, and that consequently, the analysis may itself be somewhat inaccurate or inconsistent. The information, including
all forecasts, projections, or indications of financial opportunities are provided to you on an “AS IS” basis for use at your own risk. Mastercard will not be
responsible for any action you take as a result of this presentation, or any inaccuracies, inconsistencies, formatting errors, or omissions in this presentation.
Mastercard makes no representations or warranties, express or implied, as to the accuracy or completeness
of the information contained herein, and Mastercard will not have any liability to you or any other person resulting from the use of such information by you or any
of
your representatives.
This document is intended solely to facilitate discussion between the parties. Any financial terms included herein are those that are anticipated to be included in a
proposed agreement between the parties and shall not create a legally binding or enforceable agreement or offer. The parties acknowledge that other standard
terms and conditions are also anticipated to be included in the proposed agreement between the parties and that the incentives and other terms included in this
document are subject to negotiation. If a conflict arises between the terms in this document and the terms in a definitive agreement between the parties, the
definitive agreement will govern. Neither party shall be liable to the other party as a result of the failure to fulfill any obligation described herein or the failure to
enter into any agreement.
Legal disclaimer
3

4. ©2019Mastercard.ProprietaryandConfidential.
Status Regulation
©2017Mastercard.ProprietaryandConfidential.
JUNE 21, 2018 ESS WORKSHOP

5. ©2019Mastercard.ProprietaryandConfidential.
5
NCA - CONSENSUS ON TRANSITION
Status as of 2nd January 2020:
24 NCAs have aligned with the 15-month duration set out in the EBA
Opinion: Austria, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark,
Estonia, Finland, France, Germany, Hungary, Ireland, Italy, Latvia,
Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal,
Romania, Slovenia, Spain and Sweden.
3 NCAs had explicitly stated – before the adoption of the EBA Opinion
– that they would align with the duration for transition set out by
the EBA: Greece, Lithuania and Slovakia.
UK has confirmed its decision to maintain a longer duration (18
months), without aligning with the EBA Opinion.
France has formally aligned with the 15-month duration set out in the
EBA Opinion, but maintains an extra 3-month grace period on a case-
by-case basis.
Denmark and Hungary have aligned with the 15-month duration set
out in the EBA Opinion (they had previously announced a transition of
18 months and 12 months respectively).
NCAs’ positions on the duration of transition

6. ©2019Mastercard.ProprietaryandConfidential.
Ecosystem readiness is still limited and performance of authentication and
authorization of 3DS2 transactions is still below target
20%
CNP spending of
BINs enabled on
3DS2
and growing
slowly
60%
Merchants
enrolled on
3DS2
17%
decline on 3DS2
authent’d txs
but only 1000
already sending
transactions,
only a few
actively testing it
13% if attempt
excluded,
compared to
8% for 3DS1
30%
3DS2 challenges
fail
but almost all
issuers applying
RBA
SCA Readiness SCA Performance
6
Approval rate on
exemptions flag
on Authorization
LVP, Acq TRA,
MIT in line with
other
transactions,
recurring
payment to be
improved

7. ©2019Mastercard.ProprietaryandConfidential.
Acquirer
PSP
Merchant
• In total, only 8% of the CNP volume is secured with 3DS
• Even with technical implementation: merchant resilient to use 3DS,
since the abandonment rate is very high (around 30%)
• Over 47.000 major merchants
• Market penetration of EMV 3DS on the merchant side still needs
min. 18 months (Long-Tail)
• Many merchants are still not aware of SCA *
* See ibi research study, Aug 2019: "Strong Customer Authentication“, German eCommerce before 14th September 2019
• Approx. 150 PSPs
• Major PSPs have started the implementation process
• Long-Tail of PSPs have not addressed the topic yet
• 14 Acquirer
• In Germany, acquirers are nearly finished completing the
implementation of version 2.1 with/without extensions
7
Improving the
3DS merchant
penetration
across the
entire market
is an uphill
battle

8. ©2019Mastercard.ProprietaryandConfidential.
Exemptions
©2017Mastercard.ProprietaryandConfidential.
JUNE 21, 2018 ESS WORKSHOP

9. ©2019Mastercard.ProprietaryandConfidential.
9
PSD2 SCA Exemptions and Exclusions

10. ©2019Mastercard.ProprietaryandConfidential.
10
Exemptions and RBA (TRA) is the key to ensure conversion under SCA regulation and…

11. ©2019Mastercard.ProprietaryandConfidential.
11
… therefore all market participants need to implement and support 2.1 + EXTENSIONS
#1. SCA Exemptions
#2. Merchant Fraud Rate
#3. Acquirer Country Code
#4. Secure Corporate Payment
Can be used in AReq and
RReq
#5. Whitelist Status
Can be used in ARes
EMV 3DS version
2.1 2.1+ 2.2
SCA Exemptions Y Y
Merchant Fraud Rate Y
Acquirer Country Code Y
Secure Corporate Payment Y
Whitelist Status Y Y
The following tables include a list of the new merchant data elements in EMV 3DS version 2.1+ that can be used
in Areq, RReq and ARes messages – see AN 2758

12. P S D2@ Z AL A N DO
T E S T I N G 3 D S 2
a t Z a l a n d o
A n d r e a s S c h m i d t
1 3 . 0 2 . 2 0 2 0

13. 13
> 450,000
product choices
As of September 2019
ZAL AND O AT A GLANCE
~5.4billion EURO
revenue 2018
> 60%deferred payments
> 300
million
visits
per
month
> 29
millionactive customers
> 80%of visits via
mobile devices
17
countries
> 2,000
brands

14. 14
• Credit Card Payments
• Immediate payments
• Deferred payments via „PayLater“
(FR, IT, DK)
• Zalando Plus membership fee
• Alternative Payment Methods
• PayPal
• Online bank transfer
PAYM ENT M ETHODS IM PACTED BY
PSD2

15. 15
3DS 2
A/ B TEST
M I T3dS 2 MAI 19
Jan 19 JUN 19
M ILESTONES OF THE 3DS2 IM PLEM ENTATION
I NI TI AL
P S D2
AN ALYS I S
H2/17
S tart
3DS 2
P rojeCt
Q2/18
„ Grand -
FATHE RE D”
M I T
AUG 19 FALLBACK
LOGI K
SEP 19

16. 16
BUILDING BLOCKS OF ZAL ANDO‘S 3DS2 SOLUTION
P AYM E NT P ROCE S S I NG
CC E NGI NE
3DS 2
Auth
CC
TRANS AC TI ONS
3DS 1
Auth
P CI CDE
CC S TORE
3DS 1
M E RCHANT
P LUGI N
3DS 2
CONN
Acqui rer
CONN
(1) 3DS P rotoCol
(2) US I NG 3DS
(3) I M P LEM E NTI NG M I T
(4) FALLBACK LOGI C

17. 17
3DS2 FLOW IN PRODUKTION

18. 18
• Every day ~1000 credit card transactions of
randomly selected customers receive 3DS2
treatment since May 2019
• Only immediate payments, no deferred or
recurring payments
• Goal: Reliable prediction which impact 3DS2
will have on consumers and business
3DS2 A/B TEST

19. 19
0.0%
10.0%
20.0%
30.0%
40.0%
50.0%
60.0%
70.0%
80.0%
90.0%
100.0%
Week
40
Week
41
Week
42
Week
43
Week
44
Week
45
Week
46
Week
47
Week
48
Week
49
Week
50
Week
51
Week
52
Week 1 Week 2 Week 3
Success Rate Exempted Success Rate SCA
Sucess Rate 3DS2 3DS2 Ready
3DS1 without 3DS
3DS2 READINESS & SUCCESS RATES

20. 20
92%
93%
94%
95%
96%
97%
98%
99%
100%
Week
40
Week
41
Week
42
Week
43
Week
44
Week
45
Week
46
Week
47
Week
48
Week
49
Week
50
Week
51
Week
52
Week 1 Week 2 Week 3
Device Channel Selection Device Fingerprint Challenge/SCA
LAST 3DS STEP

21. 21
60%
65%
70%
75%
80%
85%
90%
95%
100%
Week
40
Week
41
Week
42
Week
43
Week
44
Week
45
Week
46
Week
47
Week
48
Week
49
Week
50
Week
51
Week
52
Week 1 Week 2 Week 3
3DS1 Attempted Auth Unauthenticated Authenticated …next
OUTCOM E DEVICE -CHANNEL -SELECTION

22. 22
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Week
40
Week
41
Week
42
Week
43
Week
44
Week
45
Week
46
Week
47
Week
48
Week
49
Week
50
Week
51
Week
52
Week 1 Week 2 Week 3
Stopped Authenticated 3DS1 …next
OUTCOM E DEVICE -FINGERPRINT

23. 23
0%
10%
20%
30%
40%
50%
60%
70%
80%
90%
100%
Week
40
Week
41
Week
42
Week
43
Week
44
Week
45
Week
46
Week
47
Week
48
Week
49
Week
50
Week
51
Week
52
Week 1 Week 2 Week 3
Denied Exit Authenticated
OUTCOM E CHALLENGE / SCA

24. 24
50.0%
60.0%
70.0%
80.0%
90.0%
100.0%
Week 40 Week 41 Week 42 Week 43 Week 44 Week 45 Week 46 Week 47
Device Channel Selection Device Fingerprint Challenge/SCA no 3DS
AUTHORIZ ATI ON RATES
50.0%
60.0%
70.0%
80.0%
90.0%
100.0%
Week
40
Week
41
Week
42
Week
43
Week
44
Week
45
Week
46
Week
47
Week
48
Week
49
Week
50
Week
51
Week
52
Week 1 Week 2 Week 3
Device Channel Selection Device Fingerprint Challenge/SCA no 3DS

25. 25
• Far too little readiness for reliable prediction
of impact
• Authentication ≠ successful transaction
• Let‘s not hope for great SCA, instead make
use of exemptions & MIT
• Evaluate platform payment methods and
delegated authentication
• 3DS will remain moving target for quite
some while
• Optimize fallback logic
• Better measure and steer instead of believe
and trust
KEY TAKE AWAYS

26. An d r e a s S c h m i d t
a n d r e a s . s c h m i d t @ z a l a n d o . d e
Z a l a n d o P a ym e n t s
C o r e p A Y M E N T S
P r o d u c t O w n e r

27. This presentation and its contents are strictly confidential. It may not, in
whole or in part, be reproduced, redistributed, published or passed on to
any other person by the recipient.
The information in this presentation has not been independently verified. No
representation or warranty, express or implied, is made as to the accuracy
or completeness of the presentation and the information contained herein
and no reliance should be placed on such information. No responsibility is
accepted for any liability for any loss howsoever arising, directly or
indirectly, from this presentation or its contents.
DISCLAIM ER
27

28. ©2019Mastercard.ProprietaryandConfidential.
Focus
©2017Mastercard.ProprietaryandConfidential.
JUNE 21, 2018 ESS WORKSHOP

29. ©2019Mastercard.ProprietaryandConfidential.
29
MERCHANTS SHOULD FOCUS ON…
Connect to EMV 3DS
(SOONER THAN LATER:
see error correction time!)
Data Quality
and “more data”
Use of Exemptions –
go for EMV-3DS 2.1
with extensions
Authentication Express Shift intelligently
(as soon as abandonment
is low – shift volume)
Customer Information
Marketing & Leading
Consumer to ID Check

30. ©2019Mastercard.ProprietaryandConfidential.
30
ISSUERS SHOULD FOCUS ON…
Authentication
Abandonment
Exemptions
EMV 3DS 2.1 with
extensions for exemptions &
authorization (exemptions)
Authentication Express
is important for 2020
RBA adjustments
for EMV 3D-Secure
(more data)
RBA for
non-registered users
Use Smart Auth Stand-In
and Attempts handling
in Authorization
(minimum similar 3dsec1)
Use of DI and DTI-Score
from Mastercard in
Authorization
Use AAV Validation with
dynamic linkage
Registrations
Registrations
Registrations
(Customer Information &
Marketing Focus)

31. Carsten Mürl
Director Product Management
Tel. +49 69 247421019
carsten.muerl@mastercard.com
31ESS WORKSHOP