SCA (Strong Customer Authentication) is the first change introduced by the new PSD2 regulation to make payments more secure. Starting from 14 September 2019 online payments in Europe will be required to perform two or more factor authentication steps. Basic security measures like usernames and passwords will no longer be sufficient for security purposes, but it will be necessary to be authenticated with at least two of these elements:
Information that only the customer knows
Something possessed only by the customer
Something that uniquely identifies the customer
For two-factor authentication you can also use the most recent development, biometric security, already used to a significant extent on smartphones, such as a fingerprint or retina scan.
Are there exemptions to SCA? Certainly, there are transactions that do not need to use SCA:
The other improvement in consumer protection is the transition to 3DS 2.0 security protocols. The current 3DS has many limits, starting from the fact that it uses a pop-up window with a different URL. If phishing sites immediately come to mind, you’re on the right track. Basically, the risk is greater if a tab of this type is used, as it is visually very similar to the fake ones created for online fraud. There are also operational problems, for example, the saving of a set password (there are also temporary ones) for the current 3DS, which may complicate the experience of users who have multiple cards. In addition to this, is the fact that there is currently no obligation to implement 3DS as a security measure, and this increases risks for the consumer.
All of this will change with the introduction of 3DS 2.0, which will become compulsory by law on 14 September 2019. 3DS 2.0 will make it possible to use biometric methods, thus reducing the number of frauds and improving the experience of consumers, who will not be required to remember countless passwords. Another element lacking in the old system and which will be introduced is the possibility to pay with virtual wallets and not only cards. In addition, as is the case for SCA, 3DS 2.0 will not be required for subscriptions and instalment payments either. SCA and 3DS 2.0 are just two of the changes introduced with the new European PSD2 regulation. If you want to discover all of the new aspects introduced by the PSD2, we suggest you take a look at the related article: What is PSD2: a step forward towards open banking.