3-D Secure, PSD2 & Authentication

PSD2 (Payment Services Directive 2) provides the regulatory framework for the authentication of electronic payments. It is an EU directive regulating payment services and payment service providers with the goals of:

• Increasing security in payment transactions

• Strengthening consumer protection

• Promoting innovation

• Boosting competition in the market

Since the implementation of PSD2, payment service providers and merchants are required to implement Strong Customer Authentication (SCA) for electronic payments in the European Economic Area from 14th September 2019. As a result, most electronic payments now require two-factor authentication.

Electronic payments with Strong Customer Authentication currently include:

• Contact-based
  EMV chip card with PIN

• Contactless
  NFC-enabled card with PIN, smart device (e.g. smartphone, wearables)

• Online
  Credit card payments with 3D Secure
  

Exceptions apply in the following cases:

• Payments where the card issuer (bank) is not based in Europe.

• Contactless payment transactions in the low-value range, provided the following conditions are met:

  • The individual payment amount does not exceed €50, and

  • The total value of previous transactions made with a contactless-enabled payment instrument does not exceed €150 since the last Strong Customer Authentication, or

  • The number of consecutive contactless electronic payment transactions made with a contactless-enabled payment instrument does not exceed five since the last Strong Customer Authentication

If these conditions are not met, Strong Customer Authentication must be required from the consumer. Typically, the payment service provider ensures that the SCA requirements are fulfilled.

Authentication is a security check in which the bank verifies that the cardholder is authorised to carry out the transaction (e.g. by entering the card PIN).

Strong Customer Authentication (SCA) aims to make electronic payments more secure and prevent card fraud.

Two-Factor Authentication (2FA) is a process where a user identifies themselves through a combination of two different and independent components.

The most common application is withdrawing cash at an ATM, where the two factors - possessing (the bank card) and knowledge (PIN) - are combined. Nowadays, online services also use 2FA to ensure secure access to their services. For example, logging in often requires a password and a TAN, which is either generated via an app on the smartphone or sent via SMS.

Authentication is a security check in which the bank verifies if the cardholder is authorised to perform the transaction (e.g. by entering the card PIN).

Strong Customer Authentication (SCA) is a particularly secure verification process that combines multiple layers of security (often a 2-factor authentication), such as entering a password or PIN and a further security step (e.g. confirmation via a code sent by SMS). This creates the highest possible level of security to prevent misuse when shopping online.

Since 1st January 2021, banks in Europe are required to verify the identity and eligibility of the cardholder for all online transactions and, if necessary, enforce Strong Customer Authentication.

This means you must trigger the payment using the relevant protocol and transmit transaction data, allowing the bank to authenticate the transaction. If this is not done, banks are obligated to reject the payment transaction.

Strong Customer Authentication offers several advantages for merchants:

• The card-issuing bank assumes full responsibility for verifying the customer’s identity when transactions are processed according to the SCA regulations.

• You no longer bear the risk and are assured that all transactions will be executed with no revenue loss.

• You benefit from fewer abandoned purchases and a higher conversion rate.

• Fraud can be ruled out due to the completed authorisation.

A manually processed transaction at a card reader refers to transactions where the cardholder is not physically present, such as when card details are transmitted over the phone and manually entered into the card reader.

The second EU Payment Services Directive (PSD2) requires merchants and service providers to implement Strong Customer Authentication (SCA) for credit card payments. This authentication process is designed to make credit card payments more secure and prevent card fraud. As such, manually processed transactions without the physical presence of the cardholder (e.g. phone orders with manual card entry) are no longer allowed due to security reasons.

If card fraud occurs in manual transactions, the merchant conducting the transaction will be liable. Therefore, manual processing of credit card payments through PAYONE devices will no longer be possible. If your business relies on card-not-present transactions, we recommend entering into a Mail Order/Telephone Order (MoTo) agreement as an alternative.

Yes, all credit cards are affected by this regulation because it is a legal requirement that must be followed, regardless of the card issuer.