Strong Customer Au­then­ti­ca­tion: A European standard for secure payments

New re­quire­ments for the au­then­ti­ca­tion of online payments came into effect in September 2019 for the European Union and other countries in the European Economic Area (EEA). They’re a part of the second Payment Services Directive, which is also known as PSD2. The im­ple­men­ta­tion of all of the re­quire­ments likely won’t be completed until later in 2021. An important part of the PSD2 is Strong Customer Au­then­ti­ca­tion (also known as SCA or PSD2 SCA).

For now, US-based busi­ness­es are usually not subject to the SCA reg­u­la­tions, thanks to the so-called “one leg out” exception. For trans­ac­tions in which one of the parties - either merchant or purchaser - are based outside the EEA, Strong Customer Au­then­ti­ca­tion is not necessary. This means that even if you are selling to a customer in the EEA, as a US business you are generally not required to carry out SCA.

However, it’s nonethe­less advisable to fa­mil­iar­ize yourself with PSD2 SCA. For e-commerce companies that do a lot of business in the EU, there are ad­van­tages to already im­ple­ment­ing the SCA reg­u­la­tions. And there are many people who think that it’s just a matter of time until the US takes the lead from Europe and adopts the reg­u­la­tions as well.

So, what is the SCA reg­u­la­tion and what does it mean for payments in the future? Which payments are affected by it and what are the ex­cep­tions? Keep reading to find out the answers to these questions and more.

Strong Customer Au­then­ti­ca­tion is a part of the new EU reg­u­la­tions that are meant to make online payments more secure by reducing pos­si­bil­i­ties for fraud. Its main feature is adding an ad­di­tion­al au­then­ti­ca­tion step before a payment is confirmed.

According to PSD2 SCA guide­lines, a trans­ac­tion will only count as au­then­ti­cat­ed if two of the three following criteria are fulfilled:

1. Knowledge: The user enters a password or PIN that is only known to them.
2. Pos­ses­sion: The user makes the payment using a device that only they own (e.g. a smart­phone, laptop, smart­watch, chip card, or hardware token).
3. Inherence: The user iden­ti­fies themself using, e.g., a fin­ger­print, face scan, or voice recog­ni­tion.

Strong Customer Au­then­ti­ca­tion is thus a type of two-factor au­then­ti­ca­tion that provides extra assurance that the user really is who they say they are.

The idea is already an integral part of many areas of digital life, but until now it wasn’t required to implement this extra layer of security for online trans­ac­tions. Up to this point, it’s been possible for the customer to simply enter their payment in­for­ma­tion and confirm their purchase. Some companies have been using two-factor au­then­ti­ca­tion for a while, and now it’s become a legal re­quire­ment for every company in the EEA.

The revised Payment Services Directive was in­tro­duced back in September 2019 (and gives online merchants until 2021 to fully implement its re­quire­ments). However, the story of Strong Customer Au­then­ti­ca­tion goes even further back than this.

The SCA reg­u­la­tion is based on three key areas from 2007 EU leg­is­la­tion. Then as now, the most important con­sid­er­a­tions were:

1. Strength­en­ing consumers’ rights in payment trans­ac­tions.
2. Creating equal con­di­tions of com­pe­ti­tion with the reg­u­la­tion of third-party access to account in­for­ma­tion.
3. Improving security for all parties involved.

These con­sid­er­a­tions were im­ple­ment­ed in the first version of the Payment Services Directive. Since then, payment tech­nol­o­gy has developed at an as­tound­ing pace, and there’s been an increase in the number of online payment gateways and third-party providers (TPP). These providers offer consumers new pos­si­bil­i­ties for quickly and easily making payments but also open pos­si­bil­i­ties for vendors to access customers’ account in­for­ma­tion.

Access to consumer accounts was thus more or less open, leading to increased security risks. The EU’s reaction came rel­a­tive­ly quickly in the form of clear reg­u­la­tions on the ways that TPPs and online payment gateways can gain access to customer accounts.

Strong Customer Au­then­ti­ca­tion is the next step in reducing fraud in online trans­ac­tions. Its ap­pli­ca­tion to merchants outside the European Economic Area is complex and depends heavily on where a business and its sub­sidiaries are head­quar­tered. Busi­ness­es based outside the EEA should carefully check whether they are subject to SCA reg­u­la­tions.

A European law that po­ten­tial­ly affects parties outside the EEA - this is one of the aspects that makes the new SCA reg­u­la­tions so complex in their im­ple­men­ta­tion. Therefore, payment service providers have requested post­pone­ment of the deadlines for im­ple­ment­ing PSD2 SCA. And indeed, a binding deadline has yet to be set.

3D Secure is the most used au­then­ti­ca­tion protocol for online payments. It’s supported by most European debit and credit cards and thus used most fre­quent­ly. Right before the payment process is completed, the user is asked to give more in­for­ma­tion. This can take the form of a trans­ac­tion number or a fin­ger­print entered in a banking app.

For com­pli­ance with PSD2 SCA, the new version 3D Secure 2 is being released, which makes the au­then­ti­ca­tion protocol the main method for au­then­ti­cat­ing online credit/debit card payments. The im­prove­ments in the new version mostly have to do with user ex­pe­ri­ence, so that online payments can be completed quickly and easily despite the ad­di­tion­al au­then­ti­ca­tion step.

Apple Pay and Google Pay already handle online payments with an in­te­grat­ed au­then­ti­ca­tion step. Both services have im­ple­ment­ed biometric and password-protected steps, without com­pro­mis­ing on a smooth user ex­pe­ri­ence - great examples for the tech­nol­o­gy behind PSD2 SCA.

PSD2 SCA applies whenever a customer in the European Economic Area transfers money or wants to access their bank account. This means that Strong Customer Au­then­ti­ca­tion is required when:

1. A customer accesses their bank account online.
2. A customer initiates an elec­tron­ic payment process.
3. A customer is exposed to a risk of fraud in an online payment trans­ac­tion.

As with every law, there are possible ex­cep­tions to Strong Customer Au­then­ti­ca­tion. For example, when it comes to sub­scrip­tion payments, strong au­then­ti­ca­tion is only required for the initial purchase of the sub­scrip­tion. Other potential ex­cep­tions include low-risk payments, for which Strong Customer Au­then­ti­ca­tion is simply not necessary and may even be both­er­some.

There is also an exception for transfers of small amounts of money: Trans­ac­tions with a value of 30 euros or less are not subject to the rules of PSD2 SCA. To prevent the ac­cu­mu­la­tion of smaller cases of fraud, there are ad­di­tion­al rules for small trans­ac­tions:

1. Banks have to carry out Strong Customer Au­then­ti­ca­tion for trans­ac­tions made with a card that’s been used five times without a new au­then­ti­ca­tion, even if the trans­ac­tion would normally be subject to an exception.
2. If the value of the exception trans­ac­tions exceeds 100 euros, the SCA reg­u­la­tions will apply to the next trans­ac­tion re­gard­less of its value.

These ex­cep­tions will es­pe­cial­ly come in handy for small busi­ness­es. It’s important to keep in mind, though, that the customer’s bank has the last word on whether these ex­cep­tions apply or not. To avoid losing customers, it’s a good idea to offer several pos­si­bil­i­ties for payment which already comply with PSD2 SCA.