Your PSD2 questions answered

The Payment Services Directive 2 (or PSD2 for short), the first directive came out in 2007, is a piece of European Union (EU) legislation that comes into force from 14 September 2019. It aims to make banking safer, more transparent and more innovative.

This new legislation is being introduced to protect individuals and businesses when they transact online. It also satisfies the need consumers now have for a better, more frictionless online payment journey.

Yes, it will. PSD2 is a new law in the UK, so whatever future relationship the UK has with the EU, PSD2 will still be in force.

One of the new safeguards is called Strong Customer Authentication (or SCA for short). This provides extra protection against fraud when transacting online. Simply put, it asks for two checks when you make purchases over the internet or when you need to service your account online.

PSD2 is an industry-wide directive, which all banks will be obliged to follow. That said, Barclays and Barclaycard have been preparing well in advance to ensure everything is in place before 14 September.

Our aim is to achieve a balance between managing risks and maintaining the speed and convenience that transacting online provides – and customers now expect.

Since 2012, ecommerce fraud in the UK has doubled¹. So new legislation is being introduced to make transacting online safer and more secure.

That’s where Strong Customer Authentication (or SCA) comes in. Put simply, SCA will require an individual to use an additional authentication step to verify online payments or to login to their accounts online. This new step is an addition to the current single authentication layer in place today. It means that online payments and account servicing will be more secure than just using a single element, such as a simple password authentication.

¹ Source: https://www.nao.org.uk/wp-content/uploads/2017/06/Online-Fraud.pdf

When transacting or servicing your account online, SCA will require two things from the following three elements:

1. •   something you know – e.g. a password or a PIN
2. •   something you have – e.g. a phone or PINsentry card reader
3. •   something you are – e.g. a fingerprint or face recognition
4.  
5. For example, when paying online, you could use a password (something you know) or your PINsentry card reader (something you have) to authenticate your payment.
6.  
7. It’s a similar process when you log into online servicing. You could use a PIN (something you know) or your PINsentry card reader (something you have) to confirm your identity.

SCA aims to provide greater protection against fraud. Online card fraud is on the rise, and the safeguards within Strong Customer Authentication will give both businesses and consumers greater protection and reassurance.

No one wants to put obstacles in the way of paying. These extra checks will help protect your business from fraud and should, at most, only add a few seconds to your activity.

If your online purchase is considered low value, it’s likely that you won’t need to authenticate your transaction (you’ll be prompted if you do need to). There are also a few other exemptions to needing to authenticate twice:

low-risk transactions
If a transaction, through a real-time risk assessment, is deemed by us to be low risk, an exemption could apply. It’s important to note that this particular exemption comes with a complex set of conditions.

recurring payments
A series of payments of the same value to the same merchant (subscriptions and membership fees) are exempt after the initial set up. The initial set up of the recurring payment will still require authentication, but all following transactions will be exempt.

secured corporate payment exemption
Secure payments which are made through a dedicated payment protocol by businesses will be exempt from SCA.

As Barclaycard is both the issuer and acquirer, we’ll have an unrivalled view of the payment landscape, allowing us to proactively apply exemptions to a large number of transactions.

No, you can’t. This is because SCA is part of new Europe-wide legislation (the revised Payment Services Directive, or PSD2) that changes how people make payments or service their accounts online. The new regulations will apply to all payments, not just those processed by Barclays and Barclaycard.

2FA (it stands for two-factor authentication) is the method used to ensure Strong Customer Authentication.

At the moment, you only use one method (or factor) when verifying an online transaction, such as logging in with a password.

Soon you’ll use two of the following methods when authenticating online – to make doubly sure it’s you. When authenticating, the options available are from:

1. 1.  Something you know, e.g:
   Password
2. Passphrase
3. PIN
4. Secret fact
   

1. 2.  Something you have, e.g:
   Mobile phone
2. Wearable device
3. Smart card
4. Token

For example, you could pay online using a password (something you know) as you do today, and then authenticate the payment with your PINsentry card reader (something you have).

It’s a similar process when you log in to online servicing. You could use a PIN (something you know) and then confirm your identity with a one-time passcode sent to your mobile (something you have).

No, not every transaction. Thanks to our comprehensive view of the payments landscape, Barclaycard will be able to apply a number of exemptions – based, for example, on the size of the transaction or the potential for fraud. These will be applied automatically, without the cardholder having to do anything.

According to UK Finance’s 2018 half-year fraud report, there were more than a million cases of unauthorised financial fraud in the UK between January and June – a rise of 10% compared to 2017.

The safeguards embedded in SCA will give more reassurance and confidence to both businesses and individuals when buying and servicing their accounts online. There’s also the benefit of knowing your business is much less likely to be caught in fraudulent activity.

There are occasions when SCA won’t be necessary. These include things such as:

1. 1.    When it’s low-risk. Some transactions, following real-time risk assessment, will be judged to be low risk.
2. 2.    Recurring payments. A series of payments of the same amount to the same merchant (such as subscriptions and membership fees) are exempt, although the initial setup will require SCA.
3. 3.    Secured corporate payment exemption. Secure payments which are made through a dedicated payment protocol by businesses may be exempt from SCA. 

In many instances, people buying online won’t notice any difference. On those occasions when it’s required, SCA should only add a few seconds to the checkout time – a small price to pay for the increased safety and security.

Yes, at times they will. You will still be able to make contactless transactions, however you will be asked to enter your PIN more frequently. This is an additional security measure to help better protect against fraudulent payments. 

New legislation being introduced in the European Union (called PSD2) aims to make online transactions and servicing much more secure. As a result of this, we’re sending you a new card which has a new chip with enhanced security features. This will replace your existing card, which you’ll need to destroy and dispose of securely.

Your 16-digit card number will remain the same.

No, your PIN won’t change. If you currently use a signature when making payments, you’ll now need to input a Personal Identification Number (PIN). 

If you already have a PIN, you’ll need to use this. If you don’t have a PIN, we’ll send you one before your new card arrives.  

You can start using your new card straight away – it’s all set up and ready to go. Make sure you dispose of the old card securely by cutting through the chip and magnetic strip. It’ll be deactivated in 30 days’ time.

The PINsentry card reader will play an important role in helping you to authenticate online, if needed. You’ll be receiving one soon – keep it safe for when it’s needed.