Paay

The PAAY integration adds EMV 3D Secure 2.0 authentication to UltraCart checkout, so merchants can authenticate cardholders at the issuer level and shift chargeback liability on every approved transaction. PAAY runs as an authentication layer between UltraCart and the gateway, sending 150+ data points to the issuer and challenging only the small subset of orders that need it. PAAY reports up to 85% frictionless authentication rates, 45% lower fraud, and up to 9% higher authorization rates across its merchant base.

PAAY is an independent EMV 3DS authentication provider founded in 2011 and headquartered in New York City. The platform is EMV 3DS 2.1 and 2.2 certified, PCI DSS and PCI 3DS compliant, and PSD2 SCA ready. PAAY is processor-agnostic, which means merchants keep their existing gateway and processor and add authentication as a layer on top — rather than being locked into the 3DS implementation built into a single payment provider.

Without 3DS, every disputed card-not-present transaction lands on the merchant. Adding 3DS through a payment app or a gateway's built-in flow usually means a heavy redirect that drops conversion, no control over when to challenge, and no support for subscription rebills. UltraCart's PAAY integration solves both problems: merchants paste their PAAY API Key and Secret Key into Credit Card Settings, configure the challenge behavior inside Visual Builder, and 3DS runs inline on checkout with modal or panel display options.

The integration is built for serious operators. The Visual Builder checkout form element controls whether 3DS runs, when to require a challenge, modal vs. panel display, an upsell revenue cap, and second-authorization for the first rebill on subscription orders. Order views surface a dedicated 3DS Status column, the individual order view shows the full 3DS response, transaction history captures the authentication record, and Rotating Transaction Gateway History reports include a 3DS=Yes filter for downstream analysis. Authentication data is valid for rebills within a 45-day window, which is particularly relevant for merchants approaching Visa's VAMP fraud-rate threshold. Currently supported gateways: NMI, PayPal Payflow Pro, WorldPay Corporate, and Braintree (rotating gateway setups are not supported).