Stricter payment requirements in Europe could drive fraud elsewhere

ronjor · Mar 13, 2019

By Ian Barker 13 Mar 2019

From September this year the second Payment Services Directive (PSD2) comes into force across the EU. This will require payment service providers to offer strong customer authentication (SCA) and third-party access to bank accounts or risk losing their their payment provider license.
But a new report today from fraud prevention company iovation suggests that stricter requirements for fraud prevention in Europe will drive fraud to other regions such as the US.
Click to expand...

guest · Mar 20, 2019

Will PSD2 Finally Kill The Password?
March 19, 2019
https://www.scmagazine.com/home/opinion/will-psd2-finally-kill-the-password/

The EU Payment Services Directive (PSD2) will revolutionize consumer authentication. Passwords have been dying a slow death for a while, but PSD2 is likely going to deal the final death blow. Can we all say, “hip hip hooray?”
PSD2 and the SCA Requirements
With the advent of PSD2, all electronic financial transactions above €30, with a few exceptions, will be subject to Strong Customer Authentication (SCA) requirements.
In addition, a unique authentication code will be required for remote transactions (internet, mobile) that can tie the transaction to a specific amount and payee (dynamic linking).
Transforming Consumer MFA
This change is going to fundamentally alter the market and achieve what hundreds of data breaches and billions of compromised data records failed to do: transform consumer authentication. Skeptical?
Click to expand...

guest · Jun 10, 2019

Online shops fear 2FA at checkout will increase abandoned carts
June 10, 2019
https://nakedsecurity.sophos.com/20...fa-at-checkout-will-increase-abandoned-carts/

But wait, what’s this? You’re being asked for another sign of authentication before you can check out? Why, that means you have to get up! You need to go get your phone for that one-time PIN! [...] and yet another abandoned cart gets added to the heaps of can’t-be-bothered purchase exhaustion that’s (reportedly) the stuff of online merchant nightmares.
Well, that’s the dystopian, dys-profitable e-commerce future envisioned by Stripe, at any rate.

Based on input from 500 businesses and 1,000 consumers, 451 Research concluded that the EU’s online economy risks losing €57 billion (US $64.6 billion) when Strong Customer Authentication (SCA) goes into effect on 14 September 2019
We heartily support SCA
This will come as no shocker: at Naked Security, we believe that anything that makes fraud harder is to be applauded.
“The best way to approach this whole issue is for us all to agree to ditch the word ‘frictionlessness’ from our cybersecurity jargon,” said our very own Paul Ducklin…
Click to expand...

mirimir · Jun 10, 2019

Maybe a year ago, my local supermarket stopped requiring signatures for credit card payments. I asked the manager about it, and they said that it increased sales

guest · Jul 11, 2019

German banks are moving away from SMS one-time passcodes
New EU legislation might help kill SMS 2FA / 2SV / OTP
July 11, 2019
https://www.zdnet.com/article/german-banks-are-moving-away-from-sms-one-time-passcodes/

Multiple German banks have announced plans to drop support for SMS-based one-time passcodes (OTP) as a login authentication and transaction verification method.
Deutsche Bank and Commerzbank also plan to drop support for SMS OTP but have not announced a deadline, while Consorsbank plans to discontinue it by the end of the year.
NEW LEGISLATION ENTERING INTO EFFECT
In 2015, the EU revised the Payment Services Directive (PSD), a set of rules that govern online payments in the EU, and issued an updated version called the PSD2. This legislation also included a clause for strong customer authentication (SCA) mechanisms.

According to this document, SMS-based OTP is not PSD2 SCA compliant, in most of its current deployments.
The German banks were the first ones to respond to this new development and the looming PSD2 implementation deadline.
Instead, experts recommend using authenticator apps or hardware security tokens [...]
Click to expand...

guest · Jul 12, 2019

Payments Industry Warns of SCA “Disaster” – Pleads for 18 Month Extension
July 12, 2019
https://www.cbronline.com/news/strong-customer-authentication-disaster

EPSM, a European payment services industry group, has called for a minimum 18-month delay to the introduction of Strong Customer Authentication (SCA) rules under PSD2 – just eight weeks ahead of a looming deadline for implementation.
“EPSM recommends that additional timeframes of 18 months for standard applications and up to 36 months for challenging applications, (e.g. in the travel and hospitality sector) across all regions should be agreed in a harmonised migration approach” the lobby group said, warning of business disruption risks without flexibility.
“Significant Market Disruptions” – The EPSM’s Specific Fears
EPSM notes: “According to a restrictive reading of the RTS by EBA, the online payment method ‘Remote card payment using OTP [one-time password], 3DS [an XML-based protocol designed as an additional security layer for online card transactions] and card data will not be allowed without e.g. an additional password or biometry, even if secured by EMV 3DS 2.x (the highest security level possible).

It adds: “This would lead to significant market disruptions.”
Click to expand...

Rasheed187 · Jul 13, 2019

mood said: ↑

German banks are moving away from SMS one-time passcodes
New EU legislation might help kill SMS 2FA / 2SV / OTP
July 11, 2019
https://www.zdnet.com/article/german-banks-are-moving-away-from-sms-one-time-passcodes/
Click to expand...

I think this is a good move. I believe that hardware tokens should become the standard.

guest · Jul 31, 2019

Retailers must start preparing for PSD2 authentication requirements, warns Tryzens
July 31, 2019
https://tamebay.com/2019/07/psd2-retailers-must-start-preparing.html

PSD2’s Strong Customer Authentication (SCA) requirements, set to set to go live in Europe on 14 September this year, will do much to improve the security of online transactions and increase consumer trust in eCommerce. However, new research suggests that the implementation of SCA will have a huge impact on retailers, with the possibility of a loss of £50 billion in economic activity in the first year.

While these regulations will give added security to customers shopping online, data gathered by 451 Research has revealed that just 44 per cent of retailers surveyed will be ready in time for the full implementation in September.

“The regulations are only a few months away so it’s critical that retailers get on the front foot and start optimising their sites and payment processes now so they can keep the customer experience as seamless as possible when the requirements are introduced. [...]"
Click to expand...

guest · Aug 6, 2019

How Zalando addressed the introduction of PSD2
August 6, 2019
https://tamebay.com/2019/08/how-zalando-adressed-psd2.html

On the 14 of September, Strong Customer Authentication comes into force as part of the EU Payment Services Directive (PSD2).
For each payment, two factors from different groups must be acquired. Two-factor verification helps customers make their online purchases even more secure.

Currently, customers use their credit card number, expiration date and Card Verification Value (CVV) to verify the possession of that credit card. Many new features have been introduced including fingerprinting as an additional biometric authentication factor.

Zalando say after their customers have decided on a payment method and stored the corresponding information, the data is encrypted and transmitted to their customer’s bank. This secure data transfer is made possible by the technology provided by the Adyen payment platform.
The bank sends a customer notification about the additional authentication of the payment. By clicking on the message, the customer arrives at their bank app and is asked to confirm the payment with their fingerprint. After successful verification, they are automatically redirected back to Zalando’s checkout process. The order is then successfully completed.
Click to expand...

Minimalist · Aug 13, 2019

What is strong customer authentication (SCA)?

Strong Customer Authentication (SCA) represents a new effort by the European Union to standardise the protections offered to banking customers across the bloc, and improve competition as a result.
Click to expand...

https://www.itpro.co.uk/two-factor-...12/what-is-strong-customer-authentication-sca

guest · Aug 14, 2019

FCA Gives Firms More Time to Comply With Strong Authentication Rules
August 14, 2019
https://www.infosecurity-magazine.com/news/fca-firms-more-time-strong/

The UK’s financial regulator has agreed to give the country’s payments and e-commerce providers more time to comply with new user authentication rules mandated by PSD2.
The Financial Conduct Authority (FCA) said yesterday that it would provide card issuers, payments firm and online retailers with an 18-month timeline to implement the Strong Customer Authentication (SCA) checks.

“While these measures will reduce fraud, we want to make sure that they won’t cause material disruption to consumers themselves; so we have agreed a phased plan for their timely introduction.”
Jason Tooley, chief revenue officer at Veridium, said the delay was disappointing.

“Financial institutions and payment service providers have had nearly two years to prepare since the initial announcement, and there is no valid excuse for the delay in its enforcement apart from an unwillingness to participate,” he argued.
Click to expand...

FCA: FCA agrees plan for a phased implementation of Strong Customer Authentication

guest · Aug 14, 2019

Q&A: Will Strong Customer Authentication (SCA) Kill “One-Click” Shopping?
August 14, 2019
https://www.cbronline.com/qa/jackie-barwell-aci-worldwide-sca

With the news today that Strong Customer Authentication (SCA) enforcement has been extended a further 18 months, we spoke to Jackie Barwell, Director of Fraud Product Management at ACI Worldwide, about what SCA entails, the risk of fraud around its implementation, and whether it will “kill” one-click shopping.
You’ve Warned About the Possibilities for Fraud as this is Rolled Out. What’s the Concern?
If a consumer is confused about the sudden increase in requests for additional authentication (using methods they’ve never had to provide before) they could look for an explanation for this.
Fraudsters could create this explanation by, for example, sending an email which looks like it’s from a bank or merchant telling consumers that there’s a glitch in the system which they can correct by sharing XYZ personal information.
Is Online Shopping Still Going to be Friction-Free, Post-SCA?
I believe that a friction free shopping experience is still possible – but perhaps not in the way it has been described in the past.
[...]
If we all play our part in educating the consumer, then we can limit the confusion that could either be exploited by fraudsters or put people off from conducting e-commerce transactions going forward.
Click to expand...

guest · Aug 26, 2019

Consumers warned to act in advance of new online banking rules
Banking federation urges consumers to take simple measures to be ready for changes
August 26, 2019
https://www.irishtimes.com/business...advance-of-new-online-banking-rules-1.3996835

Irish consumers who use online banking could face significant disruption in the weeks ahead if they do not act on instructions from their banks, the Banking & Payment Federation Ireland (BPFI) has warned.
While the changes vary across individual banks, they will generally take the form of an additional security step before customers can access their online accounts.

“It is vital that customers follow these instructions to avoid any inconvenience when accessing their online and mobile banking services from September 14th,” the BPFI said.
Click to expand...

guest · Sep 4, 2019

Phishers Use SCA Checks to Trick Banking Customers
September 4, 2019
https://www.infosecurity-magazine.com/news/phishers-use-sca-checks-trick/

Online scammers are using changes to European banking rules around customer authentication to trick consumers into handing over their sensitive financial details, according to Which?

The consumer rights group warned that attackers are spoofing the emails being sent from banks, payment firms and e-commerce providers asking for up-to-date info, as part of new Strong Customer Authentication (SCA) requirements.
Firms across the EU are gearing up for the changes, part of PSD2, which will require a form of two-factor authentication on any online transactions over €30, although some exceptions apply.

“As long as banks send legitimate emails as a means of communicating with customers, scammers will attempt the same with fake emails,” he added.
“Email as implemented today is a terrible system for conducting business. While attempts have been made to improve the technology, none of them have taken hold.”
Click to expand...

Which?: Scam alert: fraudsters exploit new online security checks with phishing attacks

guest · Sep 13, 2019

How Will Strong Customer Authentication Impact the Security of Electronic Payments?
September 12, 2019
https://securityintelligence.com/po...n-impact-the-security-of-electronic-payments/

Effective Sept. 14, 2019, users must confirm their identity through strong customer authentication during a transaction. Authentication occurs by combining two or more factors between elements categorized as knowledge (something only the user knows, such as a password or PIN), possession (something only the user possesses, such as a mobile device or app) and inherence (something the user is, such as a fingerprint, facial scan or other biometric feature).

Strong customer authentication has some well-defined exemptions based on risk, amount, periodicity and payment channel.
A Good Opportunity for Online Commerce
Users who fail to heed the notices that all banks are providing these days risk finding themselves suddenly unable to authenticate, leading to an avalanche of cart abandonment.
On the other hand, the PSD2 and SCA will attract an increasing number of buyers thanks to the growing trust in electronic payments.
Click to expand...

guest · Sep 13, 2019

PSD2 Authentication Requirements: The Implementation Hurdles
September 13, 2019
https://www.inforisktoday.com/psd2-authentication-requirements-implementation-hurdles-a-13086

Because banks, fintech firms, merchants and payments processors in the European Union have struggled to meet the Sept. 14 deadline for compliance with the new PSD2 "strong customer authentication" requirements for electronic payments, it may take awhile for European consumers to notice authentication changes.
The Hurdles to Overcome
Security experts say many banks are not ready to comply with the PSD2 strong customer authentication requirement because they face technical and operational challenges as well as budgetary constraints.
Michael Lynch, chief strategy and product officer at Deep Labs, an IT services firm, says many European banks and payment service providers lack the necessary technologies to meet the authentication requirements.
Click to expand...

guest · Sep 17, 2019

When PSD2 Opens More Doors: The Risks of Open Banking
September 17, 2019
https://blog.trendmicro.com/trendla...2-opens-more-doors-the-risks-of-open-banking/

As more industries adapt to cater to the increasingly mobile market, the financial industry is the latest to experience a shake-up. The Revised Payment Service Directive (PSD2) – also known as Open Banking – is a new set of rules for the European Union (EU) that’s expected to affect the global financial industry.

PSD2 aims to make online banking more secure. To this end, PSD2 mandates two-factor authentication and “Dynamic Linking,” wherein an authentication code for each transaction is specific to the amount and the recipient. Additionally, banks in the UK are developing a standard called Financial grade API (FAPI), an extra layer of security in the authentication processes between new FinTech companies and banks.
API status quo and risks
While European banks were considerably late in working with APIs in 2015, an increasing amount of banks worldwide uses APIs for data sharing.
Before PSD2 went into effect, we found security issues in the APIs used by a number of FinTech companies and banks.
Click to expand...

guest · Sep 18, 2019

Barclaycard: So Far, So Good for Strong Customer Authentication
September 18, 2019
https://www.infosecurity-magazine.com/news/barclaycard-strong-customer/

Barclaycard has reported no negative impact from introducing Strong Customer Authentication (SCA) last weekend.

The new user authentication rules mandated by the European Union's revised Payment Services Directive (PSD2) were introduced by the UK's leading acquirer on Saturday, September 14.
Barclaycard analyzed transaction data from September 14 and 15 to check what effect the new two-step authentication rules were having. The company found that merchants had not experienced an increase in abandoned transactions, nor had they seen a spike in declined payments.

"Our data offers encouraging news for merchants, whose transaction volumes have been, so far, unaffected by the go-live of SCA," said Paul Adams, director of acquiring at Barclaycard Payment Solutions.
To help merchants prepare for the changes required by SCA, Barclaycard, which handles nearly half of the nation’s credit and debit card transactions, has launched Barclaycard Transact, which went live over the weekend.
Click to expand...

guest · Sep 24, 2019

Five must-have security criteria to achieve PSD2 compliance
September 23, 2019
https://www.itproportal.com/features/five-must-have-security-criteria-to-achieve-psd2-compliance/

It's no secret that customers today are demanding significantly more from their banks. For example, they now expect a fully digital and seamless experience across all channels through which the customer interacts with the bank, whether that’s for purchasing an item online or taking out a loan.
At the same time, regulations are placing far more importance on security than ever before which, combined with the relentless threat of fraud and cyberattacks hanging over banks, means ensuring customer security can’t be anything other than a top priority.

So, with these new considerations in mind, what security measures should banks and financial institutions put in place to achieve compliance with PSD2? Here are five of the most important.
Click to expand...

guest · Sep 30, 2019

PSD2 Authentication Deadline Needs to Be Firmed Up - Now
European Banking Authority Should Act Quickly to Adopt Uniform Timeline for All EU Nations
September 30, 2019
https://www.inforisktoday.com/blogs/psd2-authentication-deadline-needs-to-be-firmed-up-now-p-2794

Most European nations have delayed enforcement of the "strong customer authentication" requirements for online transactions under the European Union's PSD2 regulation, creating uncertainty about the deadline for compliance.

About 20 countries have either acknowledged or announced that a temporary extension is necessary, although they have not fully defined the length of the delays. The moves came after many organizations regulated under PSD2 said they needed more time to move to multifactor authentication.
The EBA needs to act quickly in setting a new enforcement deadline to make sure all the players involved, including banks, payment processors, fintech companies and merchants, take compliance seriously, which will help ensure the security of online payments.
Time to Get Ready
While the EBA figures out a new enforcement game plan, organizations involved in online payments need to get their act together, working with their clients and regulators to ensure that they are moving in the right direction to achieve the required strong customer authentication.
Click to expand...

guest · Aug 21, 2020

PSD2 SCA delay: an ideal time to re-evaluate authentication methods
The delay to PSD2 SCA gives organisaitons an opportunity to consider new authentication techniques
August 21, 2020
https://www.itproportal.com/feature...l-time-to-re-evaluate-authentication-methods/

Before the Covid-19 pandemic struck, the European Banking Authority had established that PSD2 Strong Customer Authentication (SCA) requirements should be fully enforced by 31st December 2020. With the global economy and many organizations now in a state of flux, the UK regulator has extended this deadline until 14th September 2021.

Effectively, now is an ideal time to re-evaluate authentication and make sure it is robust enough for a post-pandemic future.
Click to expand...

PSD2 SCA: 21st century security
The aim of PSD2 is to simply ensure that a bank or payment service provider can authenticate that the account holder is making a transaction, and not an outside party. To achieve this, SCA, a key element of PSD2, will require merchants to introduce two-factor authentication for transactions with a value of over €30.
This forces customers to take extra steps to verify their identity, potentially relying on biometric methods or SMS one-time passcodes generated by the payment provider. [...]
Click to expand...

Log in or Sign up

Stricter payment requirements in Europe could drive fraud elsewhere

ronjor Global Moderator

guest Guest

guest Guest

mirimir Registered Member

guest Guest

guest Guest

Rasheed187 Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Stricter payment requirements in Europe could drive fraud elsewhere

ronjor Global Moderator

guest Guest

guest Guest

mirimir Registered Member

guest Guest

guest Guest

Rasheed187 Registered Member

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches