PSD2, SCA and the EBA’s Opinion on SCA – Decoded
•
1 like•175 views
The strong customer authentication (SCA) requirements under PSD2 are set to go live this September. Unfortunately, there’s a general opinion that many will not be ready, which has been echoed by the European Banking Authority (EBA). In their recent opinion on SCA, the EBA has conceded that there is a lack of preparedness, especially for downstream actors such as e-commerce merchants. Join us as we walk through what the recent opinion means, including: The role of 3-D Secure in meeting SCA requirements What flexibility there may be in implementing SCA Compliance with different authentication methods for SCA Factors to consider when implementing an SCA solution How to minimize the impact of SCA on your customer journey
Recommended
Recommended
More Related Content
What's hot
What's hot (12)
Similar to PSD2, SCA and the EBA’s Opinion on SCA – Decoded
Similar to PSD2, SCA and the EBA’s Opinion on SCA – Decoded (20)
More from TransUnion
More from TransUnion (20)
Recently uploaded
Recently uploaded (20)
PSD2, SCA and the EBA’s Opinion on SCA – Decoded
- 1. 1© iovation. All Rights Reserved Angie White PSD2, SCA and the EBA’s Opinion on SCA – Decoded
- 2. © iovation. All Rights Reserved 2 6.1 Billion Devices seen by our network 45 Billion Transactions protected 26 Million Transactions protected per day 16 Million Daily logins protected 4,900 Size of our cybercrime network 69 Million Fraud reports placed by our cybercrime network Web Sites and Apps Protected 35,000
- 3. © iovation. All Rights Reserved 3 Key callouts from EBA Opinion on SCA Some flexibility on the deadline for implementing SCA The role of 3-D Secure in meeting SCA requirements Clarity on authentication factors compliant with SCA
- 4. © iovation. All Rights Reserved 4 PSD2 Strong Customer Authentication Without the friction
- 5. © iovation. All Rights Reserved 5 Clarity on SCA compliance Authentication factors
- 6. © iovation. All Rights Reserved 6 Authentication Factor Compliant Fingerprint scanning Yes Voice recognition Yes Vein recognition Yes Hand and face geometry Yes Retina and iris scanning Yes Keystroke dynamics Yes Heart rate or body movement pattern Yes Angle at which the device is held Yes Information transmitted using a communication protocol, such as EMV® 3-D Secure No Memorised swiping path No Inherence EBA opinion on authentication factors compliant with SCA Source: EBA-Op-2019-06
- 7. © iovation. All Rights Reserved 7 Authentication Factor Compliant Device possession – OTP Yes Device possession – signature (hardware or software token) Yes Card or device – QR code scanned from external device Yes App or browser – device binding Yes Card using a card reader Yes Card with possession – dynamic card security code Yes App install on the device No Card with possession – card detailed printed on card No Card with possession – printed element (e.g. OTP list) No Possession EBA opinion on authentication factors compliant with SCA Source: EBA-Op-2019-06
- 8. © iovation. All Rights Reserved 8 Authentication Factor Compliant Password Yes PIN Yes Knowledge-based challenge questions Yes Passphrase Yes Memorised swiping path Yes Email address or user name No Card details (printed on card) No OTP generated by, or received on, a device (hardware or software token generator, SMS OTP) No Printed matrix card or OTP list No Knowledge EBA opinion on authentication factors compliant with SCA Source: EBA-Op-2019-06
- 9. © iovation. All Rights Reserved 9 Timeline for implementation
- 10. © iovation. All Rights Reserved “ 10 EBA Opinion The competent authorities (CA) may decide to work with PSPs and relevant stakeholders, including consumers and merchants, to provide limited additional time to allow issuers to migrate to authentication approaches that are compliant with SCA.” Source: EBA-Op-2019-06
- 11. © iovation. All Rights Reserved 11 Execute the plan in an expedited manner Supervisory flexibility is available Under the following conditions PSPs have set up a migration plan Have agreed to the plan with their CA
- 12. © iovation. All Rights Reserved 12 3D Secure
- 13. © iovation. All Rights Reserved “ 13 EBA Opinion … communication protocols such as EMV® 3-D Secure provide a means for merchants to support the use of SCA.The EBA notes that versions 2.0 and newer support a variety of SCA methods, while trying to: • ensure customer convenience, • limiting fraud through data sharing and transaction risk analysis, • and enable the use of exemptions set out in the RTS. For those reasons, the EBA encourages the use of such communication protocols and expedient onboarding. Older protocols such as EMV® 3-D Secure version 1.0, although supporting the use of SCA, are not fully adapted to PSD2.” Source: EBA-Op-2019-06
- 14. © iovation. All Rights Reserved 14 What’s the solution?
- 15. © iovation. All Rights Reserved 15 Drive authentication decisioning based on risk signals Maximize exemptions to SCA Reduce friction for transactions subject to SCA
- 16. 16 Meet SCA Requirements of PSD2 Offer non-regulated payment methods Apply transaction risk analysis to filter out low risk transactions Filter transactions that are exempted from SCA Optimize the user experience for transactions that require SCA Alternative e-payment Methods Transaction risk analysis Optimize user experience SCA exemptions e-commerce transactions Source: Aite Group Report “PSD2: Advent of the New Payments Market in Europe”
- 17. © iovation. All Rights Reserved 17 A layered approach to meeting SCA requirements Source: Aite Group Report “PSD2: Advent of the New Payments Market in Europe”
- 18. © iovation. All Rights Reserved 18 Exemptions to SCA ‘Low risk’ transactions can be exempted
- 19. © iovation. All Rights Reserved 19 Maximize exemptions Transaction risk analysis
- 20. © iovation. All Rights Reserved 20 PSD2 Transaction Risk Analysis Requirements Maximize Exemptions
- 21. © iovation. All Rights Reserved 21 Transaction risk analysis Remote card-based payments Exemption Threshold Value Reference Fraud Rate % Remote Card-based Payments €500 <0.01 €250 0.01 - 0.06 €100 0.06 - 0.13 0 - €30 Default
- 22. © iovation. All Rights Reserved 22 Maximize Exemptions Delight Customers Merchants can contractually agree with the acquirer to share the risk of applying TRA exemptions. The acquirer can then rely on the risk management systems of the merchant Merchants retain greater control over the customer journey Reduce Friction Retaining Control of the Buyer’s Journey Leveraging Transaction Risk Analysis (TRA)
- 23. © iovation. All Rights Reserved 23 Competitive advantages The British Retail Consortium estimates that 25 percent to 30 percent of online purchases may fail when the SCA measures are rolled out. One-click Shopping Cost Savings Improved Experience *Source: Dailymail.co.uk, Online shopping code for confusion!, PUBLISHED: 16:10 EDT, 30 July 2019
- 24. © iovation. All Rights Reserved 24 Risk-based consumer authentication SCA without the friction
- 25. 25 v Or this much assurance?Do you need this much assurance?
- 26. Match Grant Access No Match or Risk Signals Account-to- Device Pairing & Risk Evaluation Persistent Session Token Login User Access Customer Access Login Device Registration SUCCESS Step-Up *** *** Device-based authentication
- 27. © iovation. All Rights Reserved 27 Something you KNOW Something you HAVE Something you ARE Mobile MFA Unified, Simplified And Personalized
- 28. 28 “How can I provide strong, unified authentication for security-conscious customers?” Through any channel, digital or physical
- 29. © iovation. All Rights Reserved 29 MOBILE APP KIOSK LOYALTY PROGRAM WEB CALL CENTER AUTHENTICATION IN NATIVE APPLICATION Companies with a strong omnichannel strategy saw an average customer retention rate of 89% Unified Access for Customers Omnichannel Authentication
- 30. 30 DEVICE-BASED AUTHENTICATION DEVICE-BASED REPUTATIONMULTIFACTOR AUTHENTICATION LOGIN CUSTOMER SUPPORT PROCESS PAYMENT THIRD PARTY ACCESS REQUEST ADD REGISTERED DEVICE TO ACCOUNT Solve For: SCA Requirements Unauthorized Access Solve For: Account Takeover Call Center Fraud Solve For: Customer Friction Account Takeover Solve For: SCA Requirements Prevent Payment Fraud Solve For: SCA Requirements Access Control Account Takeover Optimized PSP Customer Journey for PSD2
- 31. 31 DEVICE-BASED AUTHENTICATION DEVICE-BASED REPUTATIONMULTIFACTOR AUTHENTICATION LOGIN CALL CENTER PURCHASE SUBJECT TO SCA ACCOUNT SETUP PURCHASE Solve For: Fraudulent Accounts Promotions Abuse Solve For: Account Takeover Call Center Fraud Shipping Fraud Solve For: Account Takeover Customer Friction Solve For: SCA Requirements Promotions Abuse CNP Fraud Shipping Fraud Gift Card Fraud Solve For: Secure Payments Promotions Abuse CNP Fraud Shipping Fraud Optimized Merchant Customer Journey for PSD2
- 32. 32© iovation. All Rights Reserved •Q&A
Editor's Notes
- (ALL GEOS)
- (US ONLY—BUT DO WE NEED ALTERNATIVE SLIDE FOR EMEA SINCE THEY ARE USING TRUSTEV TO ESTABLISH IDENTITY? CAN THIS SLIDE STAND AS IS FOR EMEA, TOO?) For high-risk transactions like account origination and loan application, iovation can go further than device intelligence to establish identity by verifying the email and phone number provided by the consumer.
- Article 4 of the PSD2 (Directive (EU) 2015/2366) defines “Strong Customer Authentication” as authentication based on the use of two or more elements categorised as: Knowledge – something only the user knows Possession – something only the user possesses Inherence – something the user is Independent factors means that the two authentication factors have to be out-of-band, so that the breach of one doesn’t compromise the other. That’s why you have to have at least 2 of the three independent factors SCA also requires dynamic linking – being able to tie a transaction to a specific amount and payee with a unique authentication code.
- *Compliance with SCA requirements is dependent on the specific approach used in the implementation of the elements.
- *Compliance with SCA requirements is dependent on the specific approach used in the implementation of the elements. Possession of a device evidenced by an OTP generated by, or received on, a device (hardware or software token generator, SMS OTP) Possession of a device evidenced by a signature generated by a device (hardware or software token) Card or device evidenced through a QR code (or photo TAN) scanned from an external device App or browser with possession evidenced by device binding — such as through a security chip embedded into a device or private key linking an app to a device, or the registration of the web browser linking a browser to a device
- *Compliance with SCA requirements is dependent on the specific approach used in the implementation of the elements.
- In an effort to avoid the disruption of online transactions because they do not meet SCA requirements, the EBA has agreed that the competent authorities (CAs) may “decide to work with PSPs and relevant stakeholders, including consumers and merchants, to provide limited additional time to allow issuers to migrate to authentication approaches that are compliant with SCA. They went on to say however that “this supervisory flexibility is available under the condition that PSPs have set up a migration plan, have agreed to the plan with their CA, and execute the plan in an expedited manner.” The EBA stressed that such delays will only be available where payment service providers have agreed a migration plan with the competent authority. It is hoped that this additional supervisory flexibility will help merchants handle the transition. The British Retail Consortium estimates that 25 percent to 30 percent of online purchases may fail when the SCA measures are rolled out.
- communication protocols such as EMV® 3-D Secure provide a means for merchants to support the use of SCA. The EBA notes that versions 2.0 and newer support a variety of SCA methods, while trying to ensure customer convenience, limiting fraud through data sharing and transaction risk analysis, and enable the use of exemptions set out in the RTS. For those reasons, the EBA encourages the use of such communication protocols and expedient onboarding. Older protocols such as EMV® 3-D Secure version 1.0, although supporting the use of SCA, are not fully adapted to PSD2.”
- Transactions that are considered “low risk” can be exempted from the SCA requirement:
- Competitive advantages will arise for lower fraud rates as they will require less friction for higher exemption amounts. To be allowed the exemption based on transaction risk analysis, the solution must be operating in real-time and must verify a transaction against anomalies in user behavior. Check points shall include the following: Previous spending patterns of the payer Payment transaction history of the payer Location of the payer and the payee at the time of the payment Previous use of the access device or the software provided to the payment service user for SCA
- To retain control over the buyer’s journey merchants will need to work cooperatively with payment processors in order to reach the highest exemption thresholds, but this could provide a major competitive advantage on a number of fronts: One click shopping: Being able to expedite payment processing for a higher volume of transactions, i.e. all transactions below €500 vs. only transactions below €30 Cost savings: Reduce the overall number of transactions subject to higher cost SCA checks Reduced friction: Only step-up transactions above the exemption threshold or with risk signals to SCA Calculations for Reference Fraud Rate % = Total value of successful fraudulent transactions ÷ Total value of all successful transactions (including SCA and exempted)
- In a well designed system you can incorporate risk signals to tailor the level of authentication to the riskiness of the transaction. So for instance if a customer is logging in from a known device and just wants to view their balance, that’s a low risk transaction. But if the same customer want logs in from a new, unknown device and wants to transfer $10,000 out of their account; that’s a much riskier transaction. This is why risk insight is so important. Not only will it allow you to apply the right level of authentication based on risk-insight, it’ll also help you create a better user experience.
- Device based authentication isn’t reliant on personal data that has likely been breached, and is very low friction for customers. Refer back to case study
- Omnichannel flexibility: Today, authentication varies by the channel. On the web, customers enter their username and password. They enter the same credentials on your mobile app, but with a tiny, typo-prone keyboard. Imagine a time when every channel will use the same simple authentication method: the user’s device. Across the web, mobile app, streaming service, call center, and even in store.
- A recent study found that businesses with the strongest omnichannel customer engagement strategies have an average customer retention rate of 89%, as compared to 33% for companies with weak omnichannel strategies. (source: v12 Data, https://www.v12data.com/blog/25-amazing-omnichannel-statistics-every-marketer-should-know/)