It is the biggest shake-up in payment security since chip-and-PIN. When the European Payment Services Directive for Strong Customer Authentication (SCA) comes into force in September 2019, consumers and businesses can expect a sharp drop in fraud, writes FreedomPay’s Tony Hammond

Throughout the payment ecosystem, SCA will mean key challenges for online and face-to-face transactions, and for payments via cards or smartphones.

Go deeper with GlobalData

Data Insights

The gold standard of business intelligence.

Find out more

Many changes have already been implemented through existing technology: there has been a quiet revolution in customer authentication, as businesses have responded to growing security threats.

SCA is the next stage of this revolution. It applies where payer and payee are entirely inside Europe, or whether one party has ‘one foot out’. It requires consumers to provide two types of authentication from three categories: something they have (such as a card), something they know (such as a PIN) and something they are (such as a fingerprint).

From September, customers making contactless payments at a POS will be asked for additional identification at either every fifth transaction, or at a cumulative transaction value of £150 ($197) – whichever occurs soonest. This and other new layers of security may slow down payments for retailers.

So, how great an impact will SCA have? One large UK-based grocery chain estimates that it loses £1m in turnover for every extra second that a transaction takes at the POS. At a time when many high street retailers are struggling, SCA could be bad news if not handled wisely.

How well do you really know your competitors?

Access the most comprehensive Company Profiles on the market, powered by GlobalData. Save hours of research. Gain competitive edge.

Company Profile – free sample

Thank you!

Your download email will arrive shortly

Not ready to buy yet? Download a free sample

We are confident about the unique quality of our Company Profiles. However, we want you to make the most beneficial decision for your business, so we offer a free sample that you can download by submitting the below form

By GlobalData
Visit our Privacy Policy for more information about our services, how we may use, process and share your personal data, including information of your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.

Consumers are put off by long queues at the POS. They decide to buy less, or to leave the store altogether. So there are strong motivations to maintain speed and simplify transactions. This psychological hurdle applies equally online: if authentication is too tricky or time-consuming, consumers typically abandon their baskets.

On the other hand, rising online fraud – and consumers’ details being hacked – are growing threats, so people understand the need for protection, even if the specifics of authentication are less well known.

Whereas consumers have become used to tapping to pay, they will now have to revert to inserting their card and entering a PIN. Merchants are typically better informed than consumers, so an education programme could educate the public on how new rules from September 2019 will safeguard transactions.

Ideally, SCA will reduce online fraud such that transaction processing costs fall. Perhaps then, merchants will seek to negotiate lower rates from acquirers – whose premiums should be lower – as fraud declines?

New challenges

SCA standards for online transactions were implemented in 1999 via 3-D Secure version 1. But this caused delays, and consumers abandoned purchases. The latest iteration, 3DS2, brings in frictionless authentication such as facial recognition, providing more flexibility and customisation options for merchants.

Across Europe, different countries and different sectors are moving at different speeds to adopt these technologies – some are yet to introduce chip and PIN – but everyone is heading towards SCA compliance, even if they will reach it at different times.

Higher authentication standards are clearly a positive development to reduce fraud, but we foresee challenges in implementing SCA:

  1. Recurring payments: Where a consumer needs to make recurring payments, such as a magazine subscription or hotel expenses, it is impractical for merchants to need authentication each time. While some industry use cases are exempt from SCA under PSD2, others are not. In the lodging industry, for example, overnight automated processes for incremental authorisation could now require consumer interaction.One solution is for the consumer to ‘whitelist’ trusted merchants, so future payments do not require SCA – but most have yet to be educated. Merchants may want to encourage customers to do this.
  2. SME retailers: Small and medium-sized retailers need to consider whether they have SCA technology. If not, will introducing this impact their workload and the level of service they can offer to customers? They may need to rethink the way they interact with customers, in order to comply with PSD2’s SCA requirement.
  3. Keeping details current: In theory, it is the consumer’s responsibility to keep their payment details and authentication information up to date. In practice, this can be hard to achieve: your smartphone may contain more than one email address, for example. During a transaction, a payment system may seek out these details and use an out-of-date address in error.
  4. Fuzzy rules: Aspects of SCA are unclear. No two merchants operate in exactly the same way, so how far they will be subject to the rules is open to interpretation. Will it depend on the type of transaction? How will they know if they are exempt from the regulations? These questions may only become clear once issues are encountered and new precedents set.
  5. Issues with contactless payments: There are continual and growing impediments to contactless payments by regulators, aiming to reduce fraud but placing a growing burden on merchants. Payment solution providers can mitigate SCA’s additional burden by minimising contactless-authorisation times. They can also offer expert advice on the most effective ways to comply with PSD2 and 3DS2.

 

All merchants need to look at the full range of their payment-acceptance use cases and ask whether there is anything they need to change.

We believe SCA is a positive development: consumers and merchants will be more secure, just as they were 13 years ago when chip and PIN arrived. The challenge is to implement it while also enhancing the customer experience: a truly positive revolution.