Are you ready for strong customer authentication?

The revised Payment Services Directive (“PSD2”) makes significant amendments to the laws that govern payment services in the EU. This includes the introduction of enhanced security protocols called strong customer authentication (“SCA”), for online transactions worth over €30. Merchants in the UK are applying this to transactions over £30.

What is SCA?

SCA requires a dual authentication process, whereby two independent sources of validation are combined to approve a customer’s purchase. The authentication factors must be derived from two of the following three defined categories:

  1. knowledge (e.g. a password or PIN);
  2. possession (e.g. a phone or bank card); or
  3. inherent characteristics (e.g. a thumbprint or facial recognition).

British retailers and hospitality providers who take card payments in person, for instance in stores or hotels, will already be applying two-step validation for physical card transactions over £30. Such validation occurs through the chip and pin process by the combination of possession of the card and knowledge of a PIN number being required to approve purchase, rather than using contactless payment (which does not require a PIN to be used). However, the UK currently does not require SCA for online purchases, which can be completed solely through possession of a card. It is hoped that the introduction of PSD2 will boost customer protection and reduce opportunities for fraud at the point of purchase.

Which transactions must comply with SCA?

The new regime will only apply to “customer-initiated” transactions, in which both parties are in the European Economic Area (“EEA”). There are also a number of exceptions to two-factor authentication. Direct debit payments, for example, will not require SCA after the initial transaction, as they are then considered “merchant-initiated”. Another exception is a ‘trusted beneficiary’, whereby customers have the option to pre-approve a business that they trust, in order to avoid having to authenticate future purchases.

Despite these exceptions, most online card payments and bank transfers will be covered by the new rules. Regulated Payment Service Providers (“PSPs”), such as banks, building societies and credit card providers, are responsible for ensuring the application of SCA and its exemptions. Currently, many retailers rely on 3D-Secure protocols to provide authentication, including ‘Verified by Visa’, ‘SecureCode’, and ‘J/Secure’. This is likely to continue post-SCA implementation, with new versions of 3D-secure protocols made available to aid compliance with the regulations.

When must businesses implement SCA?

The original deadline for businesses to implement SCA was September 2019. However, the European Banking Authority has agreed a 15-month extension to the implementation of the new regime in the UK. Businesses therefore have until January 2021 to become compliant. This is likely to have been seen positively by a large number of retailers.  According to Andrew Cregan who advises the British Retail Consortium on its payment policy, the extension “avoids a payments cliff-edge where 25%-30% of ecommerce transactions would have been at risk of failing after September”.

The consequences of non-compliance?

In the UK, the FCA will be monitoring compliance with the new regime. Payment providers and banks are legally required to ensure PSD2 is followed. Failure to do so could result in significant fines and the FCA also has the power to remove a payment provider’s licence. In order to protect themselves, providers will likely decline transactions that do not meet the SCA criteria. As a result, merchants currently operating online storefronts will likely risk losing transaction volume if they do not ensure that their online transactions are PSD2 compliant.

Will Brexit impact SCA?

The underlying legislation for SCA, namely PSD2, has already been adopted by the UK. Therefore, on the day that the UK leaves the EU, PSD2 will continue to be in force. Further, as a policy issue, fraud prevention is of significant importance to the e-commerce sector and it is likely that the UK will continue to support measures such as SCA after leaving the EU. As a result of these factors, Brexit is unlikely to impact the requirement on businesses to comply with SCA.

Keep reading

High Court Sets Aside Injunction Granted Against Binance
Crypto fraud losses in the UK have increased by 40% in the past year according to Action Fraud. Mishcon de Reya’s Rhymal Persad, Sofia Berggren and Philippa Rees explore Piroozzadeh v Persons Unknown, and the increase in crypto-related fraud cases brought before the English Courts. High Court sets aside injunction granted against Binance: are we going to see more
Navigating Cross-Border Challenges
Fraud and asset recovery cases are increasingly being fought against unidentified defendants, as individuals hide behind computers, fake emails and false online personas. Rhymal Persad, Philippa Rees and Jordan Harrison of our member firm Mishcon de Reya explore the importance of disclosure orders, and the challenges of seeking them from foreign banks: Asset tracing in fraud cases: navigating
Article on Government’s recent Fraud Strategy Announcement
The IFG are delighted to share the below Article written by Catherine Rogerson, Associate and Linda Ali, Trainee Solicitor, Fraud Department at Mishcon de Reya LLP on the Government’s recently announced fraud strategy. Please click the link below  
Thank you Toronto! IFG Asset Recovery Conference (April 2023)
Our IFG members travelled out to Toronto for our Spring Meeting hosted by Bennett Jones taking part in another great Asset Recovery Conference. We were delighted to welcome key note speakers Hon. A. Anne McLellan P.C., O.C., A.O.E., former Deputy Prime Minister of Canada, Former Minister of Justice and Attorney General for Canada, and Inspector