Web Content Viewer (JSR 286)

The security that offers protection for your online business

Online security that helps to protect businesses and helps them prosper

American Express SafeKey® is a 3-D Secure® authentication tool that works to reduce online fraud by confirming the Cardmember’s identity with an additional password. Whether you’re a Merchant or an Acquirer, with American Express SafeKey®, you can leverage existing 3-D Secure® technology to minimise fraud through a consumer friendly solution.

There are several ways SafeKey® can help Merchants optimise operational efficiency by reducing the costs of fraud
  • Merchants can transfer the liability for chargeback losses from applicable transactions to the issuing bank with the Fraud Liability Shift (FLS) Policy. That means Merchants are not liable for losses on eligible transactions authenticated by the issuing bank in SafeKey enabled markets.
  • Our solution may decrease the number of chargebacks Merchants have, therefore lowering the need for a resource dedicated to chargebacks.
  • SafeKey works alongside existing fraud tools to validate a Cardmember’s identity.
Merchants may increase profits

  • Increase consumer confidence by reassuring them you are taking extra steps to combat fraud.
  • Put customers at ease.
  • Make customers feel comfortable spending more with you, potentially increasing existing spend and attracting new customers.
SafeKey® works with your current infrastructure

Key Steps to enroll into SafeKey


SafeKey guidelines

SafeKey logo

Frequently Asked Questions

1. How can a Merchant begin enrollment, certification and testing for American Express SafeKey®?

Merchants will be able to enroll and collect test results from testing in the SafeKey programme by contacting their American Express Middle East Merchant Relationship Manager, or email

2. Can SafeKey be turned off by the Merchant after implementation?

Technically, SafeKey can be switched off by the Merchant. However, please note that the intention of SafeKey is to reduce instances of online Card fraud. As such, American Express does not recommend turning off SafeKey at any time in accordance with guidelines.

3. How is a Card authenticated and authorised when both the Merchant and Cardmember are enrolled in American Express SafeKey?

  1. During checkout, the Cardmember inputs their payment method as American Express and provides the Card number.
  2. The Merchant Plug-in ("MPI") component running at the Merchant will communicate with the American Express Directory Server to determine if the American Express Card is enrolled in American Express SafeKey.
  3. The American Express Directory Server will communicate with the Card Issuer to determine if the Card is enrolled in the service.
  4. The Issuer will respond with a status of "Y" if the Card is enrolled, along with a URL where the Cardmember needs to be sent for authentication (the Authentication Site).
  5. The Merchant application will automatically redirect the Cardmember to the Authentication Site.
  6. At the Authentication Site, the Issuer will display the password page where the Cardmember will input the password. The Issuer will send a response to the Merchant with the authentication result. For security, the message will be digitally signed.
  7. The MPI will validate the signature and advise the Merchant of the authentication result.
  8. The Merchant can approve or decline the transaction based on the authentication result.

4. Will Merchant Terms and Conditions require changes to support the American Express SafeKey programme?

Yes, the Terms and Conditions for American Express Card Acceptance may be amended or re-issued to enable the applicable Fraud Liability Shift.

5. What is the definition of an attempted transaction?

An American Express SafeKey authentication attempt occurs when a Merchant requests to authenticate the Cardmember but the Cardmember or Issuer has not been enrolled in the SafeKey programme, and both the Merchant and Issuer are in SafeKey-designated markets. In this scenario, valid authentication data [e.g., American Express Verification Value ("AEVV") and Electronic Commerce Indicator ("ECI")] value will be required in the Authorisation and Submission messages as evidence of the attempt.

6. Will a participating Merchant obtain a Fraud Liability Shift on all Internet transactions?

No. Merchants can only obtain FLS on fully authenticated SafeKey charges. For non-authenticated SafeKey charges, or standard e-commerce charges, the standard Card Not Present Card acceptance policy applies and the Merchant is liable if the Cardmember later disputes the charge.

7. Where can a Merchant obtain Authorisation and Submission specifications for American Express SafeKey?

For Additional information on which market standard specifications currently support American Express SafeKey, Merchants may contact their American Express Middle East Relationship Manager, or email

8. Who should a Merchant contact for additional information?

For additional details, Merchants can contact their American Express Middle East Merchant Relationship Manager, or email

9. What criteria must be satisfied for a Merchant to qualify for the Fraud Liability Shift?

In order to be eligible for the Fraud Liability Shift a Merchant must:

  • Use all other American Express online fraud prevention tools available in their market
  • Utilize SafeKey
  • Maintain a Fraud-to-Gross (FTG) level of 1% or less for all SafeKey transactions