Strong Customer Authentication (SCA) Enhancements in PSD3: A Step Forward in Payment Security

With PSD3 on the horizon, the European payments landscape is set for another transformation. While PSD2 brought the groundbreaking concept of Strong Customer Authentication (SCA) to protect against fraud, PSD3 aims to take SCA to the next level, refining and expanding the rules to ensure even greater security and convenience for users. This article explores the SCA enhancements proposed under PSD3, examining how they build on PSD2’s foundations, the motivations behind these changes, and their potential impact on consumers, businesses, and the financial ecosystem.

A Quick Look Back: SCA Under PSD2

Strong Customer Authentication (SCA) was one of the most significant requirements introduced by PSD2. It requires banks and payment providers to implement two-factor authentication (2FA) for electronic payments to reduce fraud risk. Under PSD2, SCA mandates that electronic payments must be authenticated using two of three categories:

1. Something the customer knows (e.g., a password or PIN),
2. Something the customer has (e.g., a phone or card reader)
3. Something the customer is (e.g., a fingerprint or facial recognition).

These requirements apply broadly but include exemptions for certain low-risk scenarios, like low-value transactions, recurring payments, and trusted beneficiaries, to avoid friction in the payment process. While SCA has improved security, it has also brought challenges for merchants and customers, especially regarding user experience and compliance across a fragmented European market.

Achievements and Challenges following SCA Implementation in Europe

• Successes: SCA drastically reduced fraud in online payments, particularly card-not-present (CNP) fraud. For example, the European Central Bank reported a 33% decrease in fraudulent transactions in 2020 following SCA implementation.
• Challenges: Merchants faced increased cart abandonment rates due to payment friction, and inconsistent implementation across Europe created compliance headaches for cross-border businesses.

SCA Enhancements Under PSD3: What’s New?

With PSD3, European regulators aim to address some of the limitations and challenges of SCA under PSD2, proposing enhancements that focus on three main areas: user experience, security standards, and regulatory alignment. Here’s what we can expect:

1. More Refined SCA Exemptions

Under PSD2, SCA exemptions were intended to reduce friction, but they also introduced complexity for merchants trying to apply them consistently across different transactions and jurisdictions. PSD3 proposes a more granular and consistent set of exemptions:

• Low-Value Transactions: The threshold for low-value transactions may be increased, allowing a greater number of small purchases to proceed without additional authentication. E.g.: A customer buying coffee with a stored payment method could skip authentication entirely if the transaction is deemed low-risk.
• Trusted Beneficiaries List Expansion: Customers will have more flexibility in creating and managing their list of trusted beneficiaries, making payments to frequently-used merchants smoother and faster.
• Dynamic Exemptions: PSD3 could enable risk-based exemptions that adapt dynamically to real-time conditions (e.g., user behavior, transaction patterns), reducing the need for manual intervention.

These refined exemptions could make the checkout experience smoother for consumers while helping merchants reduce cart abandonment rates due to payment friction.

2. Improved SCA Consistency and Interoperability Across Europe

One of the main criticisms of PSD2’s SCA requirements was the lack of standardization in how banks and payment providers implemented SCA, leading to inconsistencies across Europe. PSD3 seeks to establish uniform standards for SCA:

• Unified API Standards: PSD3 is expected to introduce clearer guidelines for banks and payment providers to implement SCA through standardized APIs. This would enable smoother integration for merchants operating in multiple European countries and reduce complexity for cross-border transactions.
• Harmonized Regulatory Requirements: By establishing more detailed regulatory standards, PSD3 aims to create a more consistent experience across the European Union, ensuring that all parties are working under the same rules and reducing the compliance burden on multinational businesses.

This harmonization is crucial for merchants who operate across multiple jurisdictions, as it reduces the need to manage different SCA implementations for each country. For instance, a multinational e-commerce platform could implement a single SCA process for all EU customers, cutting costs and improving user experience.

3. Enhanced Biometrics and Multi-Device Authentication

PSD3 could expand the use of biometric authentication beyond fingerprints and facial recognition, incorporating emerging technologies like behavioral biometrics (e.g., typing patterns, navigation habits) that increase security without disrupting the user experience. Key enhancements include:

• Multi-Device SCA: PSD3 may allow users to authenticate across multiple devices, so customers could use a secondary device (like a tablet or smart watch) to confirm a transaction started on a primary device (like a smartphone or computer).
• Advanced Biometric Standards: With more rigorous standards, PSD3 could expand the scope and accuracy of biometrics, potentially reducing fraud risks without adding significant friction to the process.

These improvements will likely encourage broader adoption of biometrics, providing both a higher level of security and a more seamless experience for users across devices.

4. Stronger Fraud Monitoring and Real-Time Detection Mechanisms

PSD3 is expected to place a stronger emphasis on real-time fraud monitoring to work alongside SCA, allowing banks and payment providers to identify and act on suspicious transactions as they occur:

• Transaction Risk Analysis (TRA): PSD3 will likely reinforce the use of TRA to detect potentially fraudulent transactions without requiring SCA for every low-risk transaction. This allows payment providers to evaluate the risk based on transaction history, location, device information, and behavioral data.
• Real-Time Reporting: Enhanced fraud monitoring mechanisms may involve real-time fraud reporting requirements to ensure rapid response and coordination between financial institutions in cases of detected fraud.

These enhancements will provide an additional layer of security, especially for transactions that fall under SCA exemptions, while maintaining a streamlined experience for legitimate low-risk transactions.

Why These Enhancements Matter: Benefits and Implications

These enhancements to SCA have far-reaching implications for all parties involved in the payments ecosystem:

1. For Consumers: PSD3’s enhancements should deliver a smoother payment experience with fewer interruptions for low-risk transactions. Advanced biometrics and multi-device authentication will make payments more secure and convenient, especially as more users rely on multiple devices in daily life.
2. For Merchants: Merchants will benefit from a more consistent SCA framework across Europe, reducing the complexity of managing cross-border transactions. The increased scope of exemptions also reduces friction at checkout, which is particularly beneficial for e-commerce platforms, where even minor disruptions can lead to cart abandonment.
3. For Payment Service Providers and Banks: By providing a unified API standard and supporting enhanced fraud detection mechanisms, PSD3 helps payment service providers comply with regulatory requirements more easily. This enables them to offer more secure payment solutions without adding unnecessary steps to the customer journey, making it easier to compete in a digital-first payment landscape.

Challenges and Potential Hurdles in Implementing SCA Enhancements

While the proposed SCA enhancements under PSD3 bring numerous benefits, there are potential challenges to consider:

1. Technical Complexity: Implementing advanced biometric standards and multi-device authentication requires significant investment in technology and infrastructure, which could pose challenges, especially for smaller financial institutions and businesses.
2. Balancing Security with User Experience: Although SCA aims to protect users, there is a delicate balance between enhancing security and maintaining a frictionless experience. Too many security layers can frustrate users, potentially leading them to abandon online purchases. PSD3’s dynamic and risk-based exemptions will play a crucial role in managing this balance.
3. Adapting to Fast-Changing Fraud Tactics: Fraud tactics evolve quickly, and implementing real-time monitoring and reporting mechanisms is critical. However, it requires advanced data analytics capabilities that some providers may find difficult to achieve on their own, making partnerships with fraud detection specialists essential.

Looking Ahead: The Future of SCA and Payment Security

As PSD3 moves closer to implementation, these SCA enhancements represent a significant step forward in creating a safer, more user-friendly payment ecosystem. By focusing on consistent standards, advanced biometrics, and dynamic exemptions, PSD3 aims to address some of the friction and challenges introduced by PSD2’s SCA requirements.

For consumers, these changes will likely result in a more seamless and secure shopping experience, particularly for online purchases and recurring transactions. Merchants and payment providers, meanwhile, will benefit from a simplified regulatory environment that encourages innovation and cross-border growth.

The evolution of SCA under PSD3 will likely set new benchmarks for payment security worldwide, shaping the future of digital transactions as payment systems evolve to meet new demands and security threats.