Strong Customer Authentication: Difference between revisions
imported>Doug Williamson (Add summary of exemptions. Source: The Treasurer, online, What is secure customer authentication? June 2019.) |
imported>Doug Williamson (Expand definition. Source: EPSM webpage https://www.epsm.eu/wp-content/uploads/2019/07/2019-07-10-EPSM-%E2%80%93-Overview-on-SCA-for-Further-Discussion-v1.0-1.pdf?iframe=true and The Treasurer online, What is Secure Customer Authentication? June 2019.) |
||
| Line 10: | Line 10: | ||
* Something only the user possesses (e.g., mobile phone or token); | * Something only the user possesses (e.g., mobile phone or token); | ||
* Something the user is (e.g., fingerprint, facial, iris or eye vein). | * Something the user is (e.g., fingerprint, facial, iris or eye vein), sometimes known as 'inherence'. | ||
| Line 22: | Line 22: | ||
A number of exemptions are available, including trusted beneficiaries and recurring payments, low-value transactions and Transaction risk analysis (TRA). | A number of exemptions are available, including trusted beneficiaries and recurring payments, low-value transactions and Transaction risk analysis (TRA). | ||
In addition, certain transaction types are outside the scope of the rules, for example mail order and telephone orders (MOTO). | |||
Revision as of 09:40, 22 July 2019
Payments - PSD2.
(SCA).
Regulatory Technical Standards (RTS) define SCA as authentication through at least two out of the following three categories:
- Something only the user knows (e.g., passcode or PIN);
- Something only the user possesses (e.g., mobile phone or token);
- Something the user is (e.g., fingerprint, facial, iris or eye vein), sometimes known as 'inherence'.
The RTS require that the selected factors must be mutually independent in that the breach of one does not compromise the reliability of the other.
The use of a single device for authentication and shopping is expressly permitted. This means, for example, that a smartphone may be used at the same time for transacting and for authenticating the cardholder. The risk connected to the use of multi-purpose devices (e.g. smartphones and tablets) must be mitigated through the use of separated secure execution environments.
Banks are required to comply with the relevant technical standards for SCA by 14 September 2019 at the latest.
A number of exemptions are available, including trusted beneficiaries and recurring payments, low-value transactions and Transaction risk analysis (TRA).
In addition, certain transaction types are outside the scope of the rules, for example mail order and telephone orders (MOTO).
