Your PSD2 questions answered

The Payment Services Directive 2 (or PSD2 for short), the first directive came out in 2007, is a piece of European Union (EU) legislation that comes into force from 14 September 2019. It aims to make banking safer, more transparent and more innovative.

This new legislation is being introduced to protect individuals and businesses when they transact online. It also satisfies the need consumers now have for a better, more frictionless online payment journey.

Yes, it will. PSD2 is a new law in the UK, so whatever future relationship the UK has with the EU, PSD2 will still be in force.

One of the new safeguards is called Strong Customer Authentication (or SCA for short). This provides extra protection against fraud when transacting online. Simply put, it asks for two checks when you make purchases over the internet or when you need to service your account online.

When transacting or servicing your account online, SCA will require two things from the following three elements:

1. •   something you know – e.g. a password or a PIN
2. •   something you have – e.g. a phone or PINsentry card reader
3. •   something you are – e.g. a fingerprint or face recognition
4.  
5. For example, when paying online, you could use a password (something you know) or your PINsentry card reader (something you have) to authenticate your payment.
6.  
7. It’s a similar process when you log into online servicing. You could use a PIN (something you know) or your PINsentry card reader (something you have) to confirm your identity.

According to UK Finance’s 2018 half-year fraud report, there were more than a million cases of unauthorised financial fraud in the UK between January and June – a rise of 10% compared to 2017.

The safeguards embedded in SCA will give more reassurance and confidence to both businesses and individuals when buying and servicing their accounts online. There’s also the benefit of knowing your business is much less likely to be caught in fraudulent activity.

No one wants to put obstacles in the way of paying. These extra checks will help protect your business from fraud and should, at most, only add a few seconds to your activity.

If your online purchase is considered low value, it’s likely that you won’t need to authenticate your transaction (you’ll be prompted if you do need to). There are also a few other exemptions to needing to authenticate twice:

low-risk transactions
If a transaction, through a real-time risk assessment, is deemed by us to be low risk, an exemption could apply. It’s important to note that this particular exemption comes with a complex set of conditions.

recurring payments
A series of payments of the same value to the same merchant (subscriptions and membership fees) are exempt after the initial set up. The initial set up of the recurring payment will still require authentication, but all following transactions will be exempt.

secured corporate payment exemption
Secure payments which are made through a dedicated payment protocol by businesses will be exempt from SCA.

As Barclaycard is both the issuer and acquirer, we’ll have an unrivalled view of the payment landscape, allowing us to proactively apply exemptions to a large number of transactions.

PSD2 is an industry-wide directive, which all banks will be obliged to follow. That said, Barclays and Barclaycard have been preparing well in advance to ensure everything is in place before 14 September.

Our aim is to achieve a balance between managing risks and maintaining the speed and convenience that transacting online provides – and customers now expect.