American Express SafeKey is an authentication service which helps prevent unauthorized use of the American Express card online. All Amex transactions will be processed with Safekey and consumers will subsequently be redirected to a 3D verification page. It requests the consumer to confirm his/her identity with an additional authentication step. Services based on the protocol have also been adopted by Mastercard as SecureCode, by Discover as ProtectBuy, by JCB International as J/Secure, and by American Express as American Express SafeKey. Later revisions of the protocol have been produced by EMVCo under the name EMV 3-D Secure. For American Express cardholders- The 3D Secure program by American Express is called Safekey. It will help validate your identity with an additional password or unique value. With the 3D secure system, each time you will use your card to make a payment online, you'll.

• American Express Personal Security Key

Online security that helps to protect businesses and helps them prosper

American Express SafeKey^® is a 3-D Secure^® authentication tool that works to reduce online fraud by confirming the Cardmember’s identity with an additional password. Whether you’re a Merchant or an Acquirer, with American Express SafeKey^®, you can leverage existing 3-D Secure^® technology to minimise fraud through a consumer friendly solution.

Key Steps to Start Using SafeKey

• Select a certified 3DS Server Provider (see www.amexenabled.com for a list of providers who are certified for SafeKey)

• Work with your 3DS Server to complete technical set up for SafeKey

• Ensure the SafeKey logo is visible on your website and at checkout

• Contact your American Express Middle East Merchant Relationship Manager, or email MerchantSafeKey@americanexpress.com.bh if you have any questions

• Select a certified 3DS Server Provider (see www.amexenabled.com for a list of providers who are certified for SafeKey)

• Work with your 3DS Server to complete technical set up for SafeKey

• Ensure the SafeKey logo is visible on your website and at checkout

• Contact your American Express Middle East Merchant Relationship Manager, or email MerchantSafeKey@americanexpress.com.bh if you have any questions

Technically, SafeKey can be switched off by the Merchant. However, please note that the intention of SafeKey is to reduce instances of online Card fraud. As such, American Express does not recommend turning off SafeKey at any time in accordance with guidelines.

1. During checkout, the Cardmember inputs their payment method as American Express and provides the Card number.
2. The Merchant Plug-in ('MPI') component running at the Merchant will communicate with the American Express Directory Server to determine if the American Express Card is enrolled in American Express SafeKey.
3. The American Express Directory Server will communicate with the Card Issuer to determine if the Card is enrolled in the service.
4. The Issuer will respond with a status of 'Y' if the Card is enrolled, along with a URL where the Cardmember needs to be sent for authentication (the Authentication Site).
5. The Merchant application will automatically redirect the Cardmember to the Authentication Site.
6. At the Authentication Site, the Issuer will display the password page where the Cardmember will input the password. The Issuer will send a response to the Merchant with the authentication result. For security, the message will be digitally signed.
7. The MPI will validate the signature and advise the Merchant of the authentication result.
8. The Merchant can approve or decline the transaction based on the authentication result.

An American Express SafeKey authentication attempt occurs when a Merchant requests to authenticate the Cardmember but the Cardmember or Issuer has not been enrolled in the SafeKey programme, and both the Merchant and Issuer are in SafeKey-designated markets. In this scenario, valid authentication data [e.g., American Express Verification Value ('AEVV') and Electronic Commerce Indicator ('ECI')] value will be required in the Authorisation and Submission messages as evidence of the attempt.

No. Merchants can only obtain FLS on fully authenticated SafeKey charges. For non-authenticated SafeKey charges, or standard e-commerce charges, the standard Card Not Present Card acceptance policy applies and the Merchant is liable if the Cardmember later disputes the charge.

For Additional information on which market standard specifications currently support American Express SafeKey, Merchants may contact their American Express Middle East Relationship Manager, or email MerchantSafeKey@americanexpress.com.bh

For additional details, Merchants can contact their American Express Middle East Merchant Relationship Manager, or email MerchantSafeKey@americanexpress.com.bh

In order to be eligible for the Fraud Liability Shift a Merchant must:

• Use all other American Express online fraud prevention tools available in their market
• Utilize SafeKey
• Maintain a Fraud-to-Gross (FTG) level of 1% or less for all SafeKey transactions

American Express Personal Security Key