Strong Customer Authentication: Three things every merchant needs to know

Strong Customer Authentication (SCA), often referred to as multi-factor authentication, assures the card issuer and acquirer that the transaction is genuine. Now with non-cardholder present transactions (online) at least two criteria need to be met to confirm the customer’s identity, whether in the form of something they know, (PIN) have (card) or biometric (fingerprint or voice recognition).

SCA protects both the merchant/company and the customer. If a customer pays online for goods using an SCA process, but later claims it was a fraudulent transaction, the bank or card issuer accepts liability. Previously a fraudulent transaction meant that the merchant had to refund the money and incurred additional chargeback costs. With debit cards the merchant was even more vulnerable to fraud, as the money could only be credited back if there was still cash in the bank account.

The latest version of Visa’s 3-D Secure(ii) is an example of the SCA process, where customer details are used by the bank or card issuer to assess the risk of the transaction. More robust than the earlier version that simply required a password, the details are confirmed and then a one-time password or code is sent to the customer as authorisation. 3-D Secure (often referred to as ‘Verified by Visa’) provides confidence from the card issuer and bank that the transaction is genuine. If a purchase is considered low risk by the bank or card issuer, then the transaction is processed immediately with no authentication required. This is often termed ‘frictionless flow’ since it provides a smooth customer journey.

For companies selling online the initial deadline to meet the new PSD2 with SCA requirements was September 2019. However, with the UK leaving the EU and the recent COVID pandemic, the UK’s Financial Conduct Authority (FCA) has delayed the deadline until March next year. This means that any UK company that is performing transactions online (over the value of 50 euros or approx. £45) must have SCA in place by this date.

Transactions that do not meet the SCA requirements could be declined by the card issuer. The FCA will oversee and enforce the directive and repeat offenders of such transactions may be fined for non-compliance. Companies with high numbers of declined transactions could also see increased complaints, reduced customer confidence and suffer possible irreversible, reputational damage. Some transactions will be considered SCA exemptions, which include recurring payments (such as subscriptions) where the security checks are carried out in the initial set-up and ‘whitelisting’ where the recipient is a ‘trusted beneficiary’.

It can be costly and complex to implement secure online processes for transactions. With some acquirers, secure checks are carried out separately from the transaction processing. In this case the merchants must handle all of the secure online checks themselves, obtaining an authorisation code from the card issuer, and then passing it onto to the payment services provider to proceed with the transaction. Expensive to set up, the secure checks require resources and expertise to manage the mandatory technical and operational interfaces with third parties.

Working with an established payment services provider like Encoded means the transaction process and administration is managed from start to finish. The merchant captures the customer transaction and Encoded carries out all of the secure checks required by the acquirer to verify the card with the card issuer behind the scenes. With checks authorised, Encoded issues a secure link that takes the customer through the online process to complete the transaction.

Choosing the right payment service provider early on is an investment for the future. Encoded’s payment gateway is acquirer agnostic, which means that merchants can easily change banks without implementation costs.

With the next deadline of 14 March 2022 for SCA looming, now is the time to start thinking about how to protect your business from fraudulent transactions and how to comply with the new regulations.

Contact Encoded to find out how we can help you make the change.