PSD2 FAQs

The Payment Services Directive 2 (or PSD2 for short), the first directive came out in 2007, is a piece of European Union (EU) legislation that was scheduled to come into force from 14 September 2019. However, the deadline for SCA compliance has been delayed by 18 months. Following the European Banking Authority (EBA) announcement on 21 June 2019, the Financial Conduct Authority (FCA) has now agreed to a phased roll-out plan to move the UK to full compliance by 14 March 2021.

PSD2 aims to make banking safer, more transparent and more innovative. The legislation is being introduced to protect individuals and businesses when they transact online. It also satisfies the need consumers now have for a better, more frictionless online payment journey.

Yes, it will. PSD2 is a new law in the UK, so whatever future relationship the UK has with the EU, PSD2 will still be in force.

One of the new safeguards is called Strong Customer Authentication (or SCA for short). This provides extra protection against fraud when transacting online. Simply put, it asks for two checks when you make purchases over the internet or when you need to service your account online.

PSD2 is an industry-wide directive, which all banks will be obliged to follow. That said, Barclays and Barclaycard have been preparing well in advance to ensure everything is in place before 14 September.

Our aim is to achieve a balance between managing risks and maintaining the speed and convenience that transacting online provides – and customers now expect.

Since 2012, ecommerce fraud in the UK has doubled¹. So new legislation is being introduced to make transacting online safer and more secure.

That’s where Strong Customer Authentication (or SCA) comes in. Put simply, SCA will require an individual to use an additional authentication step to verify online payments or to login to their accounts online. This new step is an addition to the current single authentication layer in place today. It means that online payments and account servicing will be more secure than just using a single element, such as a simple password authentication.

¹ Source: https://www.nao.org.uk/wp-content/uploads/2017/06/Online-Fraud.pdf

When transacting or servicing your account online, SCA will require two things from the following three elements:

• •   something you know – e.g. a password or a PIN
• •   something you have – e.g. a phone or PINsentry card reader
• •   something you are – e.g. a fingerprint or face recognition
  
  
• For example, when paying online, you could use a password (something you know) or your PINsentry card reader (something you have) to authenticate your payment.
  
  It’s a similar process when you log into online servicing. You could use a PIN (something you know) or your PINsentry card reader (something you have) to confirm your identity.

SCA aims to provide greater protection against fraud. Online card fraud is on the rise, and the safeguards within Strong Customer Authentication will give both businesses and consumers greater protection and reassurance.

No one wants to put obstacles in the way of paying. These extra checks will help protect your business from fraud and should, at most, only add a few seconds to your activity.

If your online purchase is considered low value, it’s likely that you won’t need to authenticate your transaction (you’ll be prompted if you do need to). There are also a few other exemptions to needing to authenticate twice:

low-risk transactions
If a transaction, through a real-time risk assessment, is deemed by us to be low risk, an exemption could apply. It’s important to note that this particular exemption comes with a complex set of conditions.

recurring payments
A series of payments of the same value to the same merchant (subscriptions and membership fees) are exempt after the initial set up. The initial set up of the recurring payment will still require authentication, but all following transactions will be exempt.

secured corporate payment exemption
Secure payments which are made through a dedicated payment protocol by businesses will be exempt from SCA.

As Barclaycard is both the issuer and acquirer, we’ll have an unrivalled view of the payment landscape, allowing us to proactively apply exemptions to a large number of transactions.

No, you can’t. This is because SCA is part of new Europe-wide legislation (the revised Payment Services Directive, or PSD2) that changes how people make payments or service their accounts online. The new regulations will apply to all payments, not just those processed by Barclays and Barclaycard.

2FA (it stands for two-factor authentication) is the method used to ensure Strong Customer Authentication.

At the moment, you only use one method (or factor) when verifying an online transaction, such as logging in with a password.

Soon you’ll use two of the following methods when authenticating online – to make doubly sure it’s you. When authenticating, the options available are from:

• 1.  Something you know, e.g:
  Password
• Passphrase
• PIN
• Secret fact
  
• 2.  Something you have, e.g:
  Mobile phone
• Wearable device
• Smart card
• Token

For example, you could pay online using a password (something you know) as you do today, and then authenticate the payment with your PINsentry card reader (something you have).

It’s a similar process when you log in to online servicing. You could use a PIN (something you know) and then confirm your identity with a one-time passcode sent to your mobile (something you have).

No, not every transaction. Thanks to our comprehensive view of the payments landscape, Barclaycard will be able to apply a number of exemptions – based, for example, on the size of the transaction or the potential for fraud. These will be applied automatically, without the cardholder having to do anything.

According to UK Finance’s 2018 half-year fraud report, there were more than a million cases of unauthorised financial fraud in the UK between January and June – a rise of 10% compared to 2017.

The safeguards embedded in SCA will give more reassurance and confidence to both businesses and individuals when buying and servicing their accounts online. There’s also the benefit of knowing your business is much less likely to be caught in fraudulent activity.

There are occasions when SCA won’t be necessary. These include things such as:

1. When it’s low-risk. Some transactions, following real-time risk assessment, will be judged to be low risk.

2. Recurring payments. A series of payments of the same amount to the same merchant (such as subscriptions and membership fees) are exempt, although the initial setup will require SCA.

3. Secured corporate payment exemption. Secure payments which are made through a dedicated payment protocol by businesses may be exempt from SCA. 

In many instances, people buying online won’t notice any difference. On those occasions when it’s required, SCA should only add a few seconds to the checkout time – a small price to pay for the increased safety and security.

Yes, at times they will. You will still be able to make contactless transactions, however you will be asked to enter your PIN more frequently. This is an additional security measure to help better protect against fraudulent payments.

No, such transactions, known as Mail Order Telephone Order (MOTO), are out of scope of PSD2 and Strong Customer Authentication (SCA) so there will be no changes to order via mail or telephone.

When a cardholder signs up for a subscription with their Barclaycard, the initial transaction will require authenticating using SCA. Further transactions initiated by the merchant will not need this authentication. If your card number or expiry date changes, the subscription will need to be updated with the new card details.

Barclaycard Commercial does not currently offer a merchant whitelisting functionality.

Cards that are ‘saved’ in a merchant’s website are not considered to be embedded cards and will therefore require SCA on applicable transactions.

Where a card is securely lodged within a supplier’s POS system, these would be expected to be processed as ‘card not present’ transactions and therefore not require SCA.

Fuel cards are not contactless and will require a PIN to be entered each time it is used. However, if you’re using the card for online servicing or transactions, then SCA will be required.

No, travel management accounts fall within an exemption for PSD2 and SCA and therefore SCA is not required. 

New legislation being introduced in the European Union (called PSD2) aims to make online transactions and servicing much more secure. As a result of this, we’re sending you a new card which has a new chip with enhanced security features. This will replace your existing card, which you’ll need to destroy and dispose of securely.

Your 16-digit card number will remain the same.

New European Union (EU) legislation called the Payment Services Directive version 2 (PSD2) is being introduced on 14 September 2019. It aims to make online purchasing and banking much more secure. The legislation includes Strong Customer Authentication (SCA), which requires customers to authenticate their online transactions. A PINsentry card reader is a key part of this authentication process.

You can start using your new card straight away – it’s all set up and ready to go. Make sure you dispose of the old card securely by cutting through the chip and magnetic strip. Your old card will become inactive within 30 days of receiving your new one.

The PINsentry card reader will play an important role in helping you to authenticate online, if needed. You’ll be receiving one soon – keep it safe for when it’s needed.

Your new Barclaycard Commercial card has been upgraded with a new chip to give you an extra layer of security when making payments or servicing your account online. To help better protect you against fraudulent transactions, you may also be asked to enter your PIN more frequently when making contactless payments. You should stop using your old card, cut through the chip magnetic strip and dispose of it safely when your new card arrives.

No it won’t. Your PIN will stay the same. If you’ve forgotten your PIN and would like a reminder, give us a call on 0800 008 008 or +44 1604 269452 from outside the UK (24/7) from a mobile.

If you’d like to change your card’s PIN, head to any UK cash machine and follow the instructions on the screen.  

Your new card will be ready for you to use as soon as it arrives. 

Make sure you destroy your old card securely. You can do this by cutting through the chip and magnetic strip, then disposing of it safely.

Yes, you’ll need to update any regular payments that you have set up with your new card details. You can do this by contacting the business you’re making those regular payments to. 

It’s a small handheld device. It uses your card to generate unique eight-digit codes that help you authenticate your identity and transactions online, when you need to. 

New European Union (EU) legislation called the Payment Services Directive version 2 (PSD2) is being introduced on 14 September 2019. It aims to make online purchasing and banking much more secure. The legislation includes Strong Customer Authentication (SCA), which requires customers to authenticate their online transactions. A PINsentry card reader is a key part of this authentication process.

You’ll need to use your PINsenrty card reader to authenticate yourself for online transactions and banking. When you insert your card into the reader, the device will prompt you to enter your 4-digit PIN number. It will then generate a unique eight-digit code for you to use to complete your transaction or log in to your account. A different code will be generated each time you use the PINsentry card reader. 

No. There’s no charge for your PINsentry card reader device.

Yes, you may be sent additional PINsentry card readers for your other Barclays accounts.

Yes, it’ll work with all Barclays Bank accounts. They all have the same functionality so you can use any of them when you need to.

You don’t need to report your device as lost or stolen – just ask us for a new one. There’s no risk of fraud because it’s not linked to your account. You can order a replacement by contacting us on 0800 008 008.

If your device isn’t generating a code, you can get in touch with us on 0800 008 008 or +44 1604 269452 from outside the UK (24/7).

No, you’ll need both your online servicing details and your PINsentry card reader to log in. Please get in touch with us on 0800 008 008 if you need a reminder of your username.

If the batteries in your PINsentry card reader have run low, you can either order a replacement  by contacting us on 0800 008 008 or +44 1604 269452 from outside the UK (24/7) or replace the batteries. Replacing them is straightforward. You’ll need four LR44 (1.5V) batteries and a small screwdriver.

Use the screwdriver to remove the screw on the back of your PINsentry card reader, so you can take off the battery cover. When you replace the batteries, just make sure you put them in the right way up.

Yes, there is. This version of the card reader will give you audio prompts to help you through the authentication process online. If you have received a standard PINsentry card reader but require an accessible version, just get in touch with us on 0800 008 008 or +44 1604 269452 from outside the UK (24/7). as we’ll send you one. 

If you need an accessible version of a PINsentry card reader, please get in touch with us on 0800 008 008 or +44 1604 269452 from outside the UK (24/7) and we’ll send one out to you.

Your account and card details are not linked to any PINsentry card reader. There will be no security risks if you lose or misplace your device. If you haven’t received one or it’s lost, just call us on 0800 008 008 or +44 1604 269452 from outside the UK (24/7) and we’ll send you one. 

You get three chances to enter your PIN correctly – after that, your account will be locked.  To unlock your PIN, you need to visit a Barclays cash machine. You need to enter the correct PIN, select ‘PIN services’ and follow the instructions on the screen.

The PINsentry card reader you received is a standard device, but we also have an accessible version with voice prompts and a larger screen and keypad. If you require an accessible device, just call us on 0800 008 008 or +44 1604 269452 from outside the UK (24/7) and we’ll send you one.

If you require an accessible device with voice prompts and a larger screen, just call us on 0800 008 008 or +44 1604 269452 from outside the UK (24/7) and we’ll send one to you. 

The accessible PINsentry card reader is larger than the standard device. It has a larger screen to display the prompts and digits and the buttons on the keypad are also larger to help you select these with more ease. There is a speaker which tells you the next steps and also a headphone slot for you to connect your wired headphone to help hear the prompts clearly if you are in a noisy area. You can control the volume using a scroll button on the side of the device.  

The return address is on the top left hand corner of the envelope you received your device in. If you no longer have the envelope, just pop you PINsentry card reader in an envelope and address it to:

Freepost RSRZ-GKUY-TRZL
Communisis PLC
Balliol Business Park
Benton Lane
Newcastle upon Tyne
NE12 8EW

This is a freepost address, so you don’t need to attach a stamp or pay for postage.

There are several reasons why this may have happened:

Damaged card

If your card is damaged, you’ll need to order a new one. You can do this by calling Customer Services on 0800 008 008 or +44 1604 269452 from outside the UK (24/7) and we’ll send you one.

Old card

If you’ve had the card for a long time, the chances are your chip may have stopped working. Old chips are often incompatible with a PINsentry card reader. You’ll need to order a new card using the details above.

Wrong card

You’ll need to use your current Barclaycard that is Chip and PIN enabled. If you don’t have the correct card, just call us using the details above. 

Here’s how you can authenticate for online servicing using a PINsentry card reader:

When prompted by the online servicing page you’re visiting, enter the last 4 digits of your card number on the screen and pop your Barclaycard or your authentication card into your PINsentry card reader with the chip facing down and press Identify.

The card reader will then ask you to enter your card’s PIN. This is the PIN you’d usually enter into a card terminal when making in-store purchases. Once you’ve entered this, press Enter.

 You’ll then be shown a unique eight-digit code on your PINsentry card reader’s screen. Put this code into the box provided in the online servicing page.

That’s it – your authentication should be complete.

If you input your authentication code incorrectly the first time, you will have four further attempts to enter it correctly. After five failed attempts your account will be blocked and you will need to contact Customer Services on 0800 008 008 or +44 1604 269452 from outside the UK (24/7).

PSD2 will apply to online banking and most global online payments made with a European issuer. Because Barclaycard is a UK card issuer, the new legislation will affect any transaction using one of our cards – even if you live or use it on the other side of the world. In preparation for PSD2, we will be sending you a new Barclaycard.

Your new card has been embedded with an updated Chip which provides you with an extra layer of security for online transactions and servicing. 

Your new Personal Identification Number (PIN) is for use with your new card.  From now on when you use your new card to make in-store payments you will need to enter this 4-digit PIN into the merchant’s card terminal. If the merchant’s card terminal is not PIN enabled, you can still sign for your purchases.  

Using a PIN aims to identify genuine cards and help combat fraud. Your PIN is unique to your new card. When making a transaction, the Chip technology embedded in your card checks the PIN you entered in the keypad against the PIN held on the chip. This verifies your identity instead of checking a signature on a receipt. 

Your PIN will arrive separately before your new card. If you don’t receive it, please call 1-877-821-6566 and let our Customer Services Team know.

It’s on its way and should arrive shortly after you receive your PIN. If your Barclaycard Commercial card doesn’t arrive within 30 days, please call 1-877-821-6566 and let our Customer Services Team know

No, your 4-digit PIN is for in-store payments only and should not be provided to any online merchant. You should ensure you PIN is kept secure and not shared with anyone. 

Once your new card arrives, you need to destroy your old card securely by cutting through the chip and magnetic strip and disposing of it safely. Please bear in mind that your old card will become inactive within 30 days of receiving your new one.

It’s a small handheld device which identifies your card and PIN to generate unique eight-digit codes that help you authenticate your identity and transactions online, when you need to. 

PSD2 legislation includes Strong Customer Authentication (SCA), which requires customers to authenticate their online transactions. At the moment, you may only use one authentication method such as a password to access online banking and transactions. However, SCA will require an additional step and a PINsentry card reader is a key part of this authentication process as it is one of the methods for use with your Barclaycard.

When authenticating yourself online, you’ll need to insert your card into the device and it will prompt you to enter your 4-digit PIN. It will then generate a unique eight-digit code for you to use to complete your transaction or log in to your account. A different code will be generated each time you use your PINsentry card reader so there is no need to remember it or write it down. 

No. There’s no charge for your PINsentry card reader device and it will be sent to you shortly after you receive your new card. Your card, PIN and PINsentry card reader will all arrive separately. 

You can log in with your username, password and a six-digit verification code sent to your mobile phone. To do this, please ensure we have your up-to-date mobile number so we can send this to you when you request it. You can update your details in CentreSuite by clicking on your name in the top right hand corner of the home page and selecting ‘edit personal information’.

You don’t need a company issued mobile phone, you can use your personal mobile phone to receive your one-time verification code. 

You will be unable to log in to Centresuite without a one-time verification code sent by text message. As part of the EU legislation, PSD2, you will require two forms of authentication. A single authentication such as a username or password will not be sufficient to comply with legislation.

Currently, the only way to access Centresuite is by entering a one-time verification code sent to your mobile by text message when you are logging in. You may be able to move to either Barclaycard Spend Management (Visa) or Barclaycard Commercial Online Services (MasterCard). These platforms require your card details and a verification code from a PINsentry card reader. If you would like to do this, please contact your Barclaycard Relationship Manager.

Time out messages appear when your account has been inactive for five minutes. This helps to keep your account protected. If your session times out, just log in again. 

Centresuite and Precisionpay do not require a card to log in.

You will only need your new card to log in to Barclaycard Spend Management, Barclaycard Commercial Online Servicing or Barclaycard Precisionpay Reporting.

If you don’t have a Barclaycard Commercial card, you will need an Authentication card. If you have not received one, please contact us on 0800 008 008 or +44 (0) 1604 269 452 from abroad (24/7).

It’s a new way to help you confirm your identity when accessing Barclaycard online servicing. You’ll need the authentication card to confirm it’s really you whenever you log in, giving you an extra layer of security. It has a zero credit limit and is used for verification step only. You won’t be able to make any payments with it.

If you have a transactional card and you also service your account online, you won’t receive a separate authentication card. You will just use your Barclaycard Commercial card to log in to online serving. 

No, you won’t be able to make any transactions or purchases online or in store with it. The authentication card is used for access to online servicing only. 

If you need an Authentication card for servicing your company’s account online, ask the administrator of your company’s Barclaycard Commercial account to request one through their online servicing account. You will then be sent an Authentication card, PIN and PINsentry card reader. Delivery may take 7 to 10 business days.

You can use your PINsentry card reader to authenticate yourself when logging in.

One-time verification via text message isn’t available for logging into Barclaycard Business Online Servicing. 

You should’ve received a PINsentry card reader in the post. If it hasn’t arrived or it’s lost or broken, you can order a replacement by calling us on 0800 008 008 or +44 1604 269452 from outside the UK (24/7). We’ll then deliver the card reader to your registered address.

In the meantime, you can still use your current login password and memorable word to log into Barclaycard Business Online Servicing. Just keep in mind that you won’t be able to complete some actions without your PINsentry card reader once you’re logged in. These include viewing your PIN and changing your contact details. Once you have received your PINsentry card reader, you will no longer be able to log in with just your username and memorable password. 

This is an extra layer of security that helps us keep your account secure. It’s being introduced as part of new EU legislation, the revised Payment Services Directive, which requires you to make additional checks for online transactions, high fraud risk activities and online servicing. The additional check is to make doubly sure it’s you.

You only have five attempts to log into your online servicing account. After five unsuccessful attempts, you’ll need to give your account time to reset. You don’t need to call us, it will automatically reset and can take up to an hour to do this. 

No. You can carry on using your current password to log in.  

It may be that the view PIN has timed out - to keep it secure, your PIN is only shown on your screen for five seconds. If you missed it, you’ll need to authenticate yourself so you can view it again.

If you’re logging in again for the first time using the extra verification step, you will need to clear your cache in the internet browser to first. You can do this quickly by clicking on the ‘Tools’ or ‘Settings’ option in your internet browser. If you are unsure call us on 0800 008 008 or +44 1604 269452 from outside the UK (24/7).

A Third Party Access (TPA) platform allows your account information from other banks to be shown in one place, so you don’t need to sign in to other online servicing accounts or apps separately. You will need to give consent for this information to be shared so you can view it in one place. This is a new step that helps us keep your account and details secure. It’s also a requirement of a new EU legislation called the revised Payment Services Directive (PSD2), which requires you to verify yourself when making payments and servicing your account online. 

The consent will be valid for 90 days. Once it expires, you’ll have to submit a new consent through your online account servicing page; Barclaycard Online Servicing. 

You can’t change an existing consent, once you have submitted approval it is valid for 90 days, but you can cancel a consent at any time. When an existing consent expires after 90 days, you will need to resubmit it – you can make changes before submitting a new consent form. 

You can cancel a consent form at any time through Barclaycard Online Servicing. You’ll be able to see the status of all your consents here, including whether they are active or inactive and the time remaining on each consent form.  

If you already use the Barclays app with your existing Barclays account, you may be able to use the mobile PINsentry option. If you can see your Barclaycard commercial account details in your Barclays app you can select and use the mobile PINsentry. If you cannot see your Barclaycard Commercial account details in your Barclays app, then contact us to update your details to link the two accounts on 0800 008 008 or +44 1604 269452 from outside the UK (24/7).

You can use the Barclays app or a PINsentry card reader to authenticate yourself when making payments or accessing your account online.

If you don’t have the app, but you do have a Barclays account, you can download it from your app store. If you don’t have a Barclays account, you cannot use the app.

It’s available to download from your app store right now.

App Store and Google Play

Sorry, but the Mobile PINsentry option is not available on the Barclaycard app. It is currently only available on the Barclays app. If you have a Barclays account and the Barclays app, you may be able to see your Barclaycard commercial account on there and can use the Mobile PINsentry options. If you cannot see your Barclaycard Commercial card account, you’ll need to use to use your PINsentry card reader instead.

Yes, you can link your accounts together in the Barclays app. To do this, you’ll need to get in touch with our support team on 0800 008 008 or +44 1604 269452 from outside the UK (24/7). Unfortunately, you can’t link your accounts together in your online servicing account. 

As a result of the new EU legislation called PSD2, we have changed the way you access online servicing. There will now be a new log in page and you will be required to verify yourself by using your Barclaycard Commercial card or Authentication card and your PINsentry card reader. When you have logged in, you can select the servicing platform you need and continue as normal.

If you use Barclaycard Spend Management, Barclaycard Commercial Online Servicing or Barclaycard Precisionpay Reporting (SNAP), you will be able to access them through the new log in page – you don’t need to log in separately.

There is no change to the log in page for Centresuite or Presicionpay.

No. The BCos log in page is still live, but you will not be able to log in to your account using this page. The PSD2 regulation requires two forms of authentication to log in to online servicing, but this is not available through the current BCOS page. If you try to log in using the existing page, your log in attempt will fail. You should use the new log in page to access BCos.

No, when you try to access the log in page for SNAP, you will be redirected to the new single sign-on page.  Once you have authenticated yourself and logged in, you will be able to select SNAP from the homepage and continue to your usual SNAP homepage.

No. The BSM log in page is still live, but you will not be able to log in to your account using this page. When you enter your log in credentials, you will see an onscreen message with a link to the new log in page.

Yes. The log in page and method for Precisionpay has not changed.

All the online servicing platforms are provided by different companies, each offering different solutions and steps for online verification, Online verification steps are a requirement as part of the EU’s new regulation, the revised Payment Services Directive. 

Time out messages appear when your account has been inactive for five minutes. This helps to keep your account protected. If your session times out, just log in again. 

Yes, you will need your new card to log in. If you don’t have a Barclaycard Commercial card, you will need an Authentication card. If you have not received one please contact us on 0800 008 008 or +44 (0) 1604 269 452 from abroad (24/7).

You won’t need a card if you’re logging into Centresuite or Precisionpay. 

Email addresses are used as account usernames and each account has a unique email address registered to it. If you require access to an additional account, you will need to provide a new email address which will then be assigned to your additional unique account.

After entering your username and password and you select ‘Take me to my account’, a message will appear at the bottom of the page which is a Pop Up Blocker. Select ‘Options for this site’ and click ‘Always Allow’. You will need to go back to the main login page for the amended settings to take effect. You should only need to do this once, then you will be able to log in and continue to your account as usual.