How to meet PSD2 Strong Customer Authentication (SCA) dynamic linking requirements with Authsignal

What is PSD2? What are the PSD2 revisions?

The second Payment Services Directive (PSD2), adopted in 2015, sets rules for retail payments in the EU, both euro and non-euro, domestic and cross-border. PSD2 builds on the first Payment Services Directive (PSD1) from 2007, which created a harmonized legal framework for an integrated EU payments market.

In 2022, the European Commission evaluated PSD2, focusing on charges, scope, thresholds, and access to payment systems. One of its critical components is the Strong Customer Authentication (SCA) requirement, designed to increase the security of electronic payments and reduce fraud.

How to comply with PSD2's Strong Customer Authentication (SCA)?

This step-by-step guide is designed to show how merchants and payment service providers can implement authentication challenges in order to comply with PSD2's Strong Customer Authentication (SCA) dynamic linking requirements while also ensuring a seamless customer experience by using passkeys with Authsignal.

Key Points of Strong Customer Authentication (SCA):

1. Purpose:
   • To enhance security for online payments and transactions.
   • To reduce fraud and increase consumer trust in electronic payments.
2. Requirements:
   • SCA mandates the use of two or more independent elements from the following categories:
     • Knowledge: Something the user knows (e.g., password, PIN).
     • Possession: Something the user has (e.g., mobile phone, hardware token).
     • Inherence: Something the user is (e.g., fingerprint, facial recognition).
3. Applicability:
   • Applies to electronic payments within the European Economic Area (EEA).
   • Covers online transactions, bank transfers, and access to payment accounts.
4. Exemptions:
   • Low-value transactions (under €30).
   • Recurring transactions (after the first SCA-protected payment).
   • Transactions with trusted beneficiaries (after initial SCA).
   • Low-risk transactions based on real-time fraud analysis.
5. Implementation:
   • Financial institutions and payment service providers must comply with SCA requirements.
   • Retailers must ensure their payment processes support SCA, impacting user experience.
6. Impact:
   • Enhances security and trust in digital payment systems.
   • Introduces challenges for merchants and payment service providers in ensuring compliance while maintaining a smooth customer experience.
   • Encourages the adoption of advanced authentication technologies.

SCA is a critical element of PSD2, which aims to secure electronic payments, safeguard consumers against fraud, and foster innovation in the financial sector.

In this blog, we'll demonstrate how Authsignal can help you meet the SCA requirement, including the critical aspect of dynamic linking, using passkeys, and contextual messaging.

Creating an action for a user payment.

Let’s create an action configuration for our payment action and head to the Rules section.

Payments that are under €30 are exempt from the PSD2 Strong Customer Authentication requirement. Therefore we can create a rule to require authentication when the payment amount exceeds €30.

Implementing dynamic linking with contextual messaging

Dynamic linking is a crucial component of the Strong Customer Authentication (SCA) requirements under the Revised Payment Services Directive (PSD2). It ensures that electronic payment transactions are securely linked to specific transaction details, enhancing the security of the transaction process.

Authsignal’s contextual messaging feature takes care of the following aspects:

• Dynamic linking requires that the authentication process is uniquely tied to the amount of the transaction and the payee.
• Payment service providers must ensure that users can clearly see and verify transaction details during the authentication process.

When a user has been required to strongly authenticate before making their payment, we can utilize contextual messaging to show the user the transaction details.

In the contextual messaging section for your payment action configuration, you can create and preview a message that your users will see when authenticating.

We used a custom data point called, paymentAmount , in our Require SCA rule. Any custom data points we use in our action’s rules are available to be inserted into our contextual message.

Integrating the payment action into your application

Now that we have our payment action configured to meet the SCA requirement let’s add it to our e-commerce application.

Visit the Integration tab to get a snippet that you can add to your code, e.g.

const { url } = await authsignal.track({
  userId: user.id,
  action: "payment",
  redirectUrl: "<https://yourapp.com/callback>",
  custom: {
    paymentAmount: payment.amount,
  },
});

Then follow our Using the pre-built UI guide to finish off your integration.

Demo of Strong Customer Authentication (SCA) using passkeys with Authsignal

With our integration complete, we can see that the user is being required to strongly authenticate with a passkey. The transaction details are also presented to the user: “Authenticate before proceeding with your payment of $262”.

By leveraging Authsignal, businesses can efficiently meet PSD2's Strong Customer Authentication (SCA) requirements, including dynamic linking, to ensure secure and compliant transactions. Authsignal's advanced authentication solutions, such as passkeys, enhance security, reduce fraud, and provide a smooth user experience, making it an essential tool for navigating the complexities of modern digital payments.

Create a free account and start integrating passkeys with Authsignal.