Arising from PSD2, Strong Customer Authentication (SCA) is a new set of requirements consisting of an additional security step for some online and in-store purchases. These purchases will require the added layer of security known as two-factor authentication for consumers to confirm their identity by providing information from at least two of the three categories below:
Knowledge:
Something they know
(such as a password or PIN).
Possession:
Something they have
(such as a mobile phone, card reader or other device evidenced by a one-time passcode).
Inherence:
Something they are
(such as a fingerprint).
What does this mean for Issuers and Acquirers?
SCA will create opportunities for Payment Service Providers (PSPs) such as Issuers and Acquirers and their customers. SCA aims to benefit every party of the payment ecosystem by making online and contactless payments even safer and offering more protection against the risk of fraud. PSPs have a key role to play in ensuring the success of SCA by adopting solutions that will make them compliant with the regulation:
Online payments. 3-D Secure is the framework, which supports SCA. By enrolling for 3DS, Issuers, Acquirers and Merchants can enable greater completion of transactions securely and more accurately. While upgrading to the newest version of 3DS – 3DS 2.2 is the most up to date – they will create the best customer experience especially when purchasing in-app and on smartphones.
Contactless payments. Visa is offering two distinct primary solutions to enable Issuers to apply the contactless exemption for Contactless transactions and to apply SCA when it is required:
- Card Based Solution - This solution tracks the count or cumulative monetary amount of contactless payments transactions within the chip of the card. For this solution to work, card re-issuance will be required.
- Host Based Solution - Visa has introduced two new authorisation response codes (1A and 70), which will help the payment ecosystem to achieve an optimal and frictionless cardholder experience. Some European Issuers will start to use these response codes as early as September 2019. Point of sale (POS) PSPs can now activate these codes within their host system to prepare their businesses and merchants for SCA.
For Visa’s approach to SCA, see: Delivering a secure and seamless customer experience.
Implementing Strong Customer
Authentication (SCA) for Travel & Hospitality
Download the implementation guide
Authentication (SCA) for Travel & Hospitality
Download the implementation guide
Visa commitment to business
Visa is committed to our partners. We innovate to help our partners deliver solutions that offer security and convenience. To find out more about how Visa innovates in digital commerce, click here.
On 21, June 2019, the European Banking Authority (EBA) published an opinion on the Payment Services Directive 2 (PSD2) and SCA. The opinion further defines what qualifies as a factor. Visa is actively engaging with local regulators on this.
Visa has collaborated with the industry to recommend an 18-month transition period to be applied across all member states. This recommendation is supported by a detailed roadmap to readiness with realistic milestones. In some member states, local regulators have already publicly announced support for an extension of this duration, others have yet to issue a formal statement.
On 1 August 2019, Visa co-signed a Joint Industry Statement from the European Payments Institutions Federation (EPIF). The statement advises all Issuers to continue authorising transactions in the same way as they do today, after 14 September and up to the end of the transition period to be confirmed by the EBA and/or national regulators. This is important to avoid large-scale disruption to e-commerce across Europe.
Issuers will be expected to continue to use legacy solutions for authentication and fraud mitigation strategies. Visa will be actively monitoring authorisation responses to identify Issuers that are reporting an increased number of declines – working with them to find solutions that allow customers to continue to make seamless payments.
Visa will use its overview of the payments ecosystem to support local regulators with information around ongoing progress with SCA implementation and the impact on European payments.