Payment security: which changes will DSP2 introduce in Europe from September?

New rules on strong customer authentication (SCA) will come into force in Europe on September 14 2019, as set out by PSD2, the EU’s revised directive on payment services, relating also to online payments. Adapting to the new requirements will be a complex affair, which may translate into a lengthy transition period.

PSD2 came into effect in January 2018, and focuses on three main areas. The first is that banks are obliged to put their clients’ payment data at the disposal of third-party providers (TPP), the authorised online service providers operating payment accounts and apps. For consumers, PSD2 pledges to ensure the quick reimbursement of disputed transactions, a ban on overcharging and greater rights protection.

But one of the most prominent changes introduced by the directive will be the obligation for online payments to feature two independent authentication elements. The term ‘independent’ refers to three pre-defined categories: authentication needs to be based on possession (for example of a smartphone, a SIM card or a physical authentication key), on knowledge (for example of a password, date of birth, or a pet's name) or on biometric data (facial recognition, voice or fingerprint).

Besides the host of technology tweaks implicit in PSD2, which will be also addressed by e-tailers associations like FEVAD in France, the changes brought about by the directive represent a commercial challenge for e-tailers. The latter constantly strive for minimal friction in the various stages of online purchases, from when a product is added to a basket to the actual payment. Recently, the Facebook group in France estimated that earnings losses due to abandoned baskets amount to €20 billion. It remains therefore to be seen which forms the combination of payment authentication elements will take for European e-tailers.

Payment security: which changes will DSP2 introduce in Europe from September?

See also