# Check MFA Eligibility for PANs
source: https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/3rdparty_authentication_scof/step1/index.md

## Step 1. Check MFA Eligibility for PANs {#step-1-check-mfa-eligibility-for-pans}

An Integrator can check if a PAN is eligible for TAF by checking the eligibility for Multi-factor Authentication (MFA) and merchant Fraud Liability Protection (FLP) during [card enrollment](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/3rdparty_authentication_scof/step1/index.md#card-enrollment) and [retrieval](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/3rdparty_authentication_scof/step1/index.md#retrieve-card-details). If eligible, Mastercard Checkout Solutions lists the valid authentication methods for an Integrator to perform the authentication on their end.

## Card Enrollment {#card-enrollment}

Use the enhanced [Enroll Card](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#card) API to create a token, associate it with a consumer profile and determine merchant Fraud Liability Protection (FLP) eligibility in Secure Card on File.

FLP is applicable for *Tokenization while Transacting* and *Add Card Tokenization* use cases within [PAN Tokenization](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/use-cases/card-on-file/card-enrollment/pan-tokenization/index.md).
Diagram taf-card-enrollment

Following are the detailed steps:

1. Cardholder initiates a transaction by entering card details on a merchant/commerce platform's website.
2. Integrator encrypts the card object using the `src-fpan-encryption` public key. Mastercard will then decrypt the card using the private part of the `src-fpan-encryption` key. Refer to [Public Keys Mastercard Provides](https://developer.mastercard.com/mastercard-checkout-solutions/tutorial/key-management/index.md#public-keys-mastercard-provides) for more details on how to obtain these public keys.
3. Integrator sends a [Enroll Card](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#card) request with the encrypted PAN details. Use the `srcCorrelationId` to keep track of each unique request.  
   Note: Mastercard recommends that you also populate cardSecurityCode (CVC2), `cardSource` (with the string `CARDHOLDER`) and include additional information in the `decisioningData` object to support the issuer's decision on tokenization.
4. Mastercard Checkout Solutions creates a unique token for the PAN.
5. If the tokenization request is successful, you will receive the card enrollment response with `srcDigitalCardId`. The `maskedCard` object indicates MFA Eligibility and if Fraud Liability Protection (FLP) is supported for this card.   
   For example, `authenticationMethodType`=*3DS* indicates 3DS is supported for this card.

## Retrieve Card Details {#retrieve-card-details}

For a card already tokenized in Secure Card on File, retrieve the masked card details, MFA and merchant fraud liability protection eligibility by using the [Get Cards](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#card) API.
Diagram taf-getcards

Detailed steps are explained below:

1. Cardholder logs in and initiates a transaction on an existing card stored on file on a merchant/commerce platform's website.
2. Integrator sends a [Get Cards](https://developer.mastercard.com/mastercard-checkout-solutions/documentation/api-reference/apis/index.md#card) request with the unique `cardId`.
3. Mastercard Checkout Solutions responds with masked card details along with MFA Eligibility and if fraud liability protection is supported for this card.   
   For example, `authenticationMethodType`=*3DS* indicates 3DS is supported for this card.