Strong Customer Authentication (SCA) is a security standard for electronic payments that was introduced as part of the second EU Payment Services Directive (PSD2). SCA aims to make online payments and access to payment accounts more secure by requiring two-factor authentication for certain transactions.

Legal basis

The legal basis for SCA can be found in PSD2, which came into force on January 13, 2018. In Germany, PSD2 was implemented by the Payment Services Supervision Act (ZAG) and amendments to the German Civil Code (BGB). The technical details of SCA are set out in the Regulatory Technical Standards (RTS) of the European Banking Authority (EBA).

Core elements of the SCA

SCA is based on the principle of two-factor authentication and requires at least two of the following three elements:

1. knowledge: Something that only the user knows (e.g. password, PIN)
2. Possession: Something that only the user possesses (e.g. smartphone, chip card)
3. Inherence: Something that the user is (e.g. fingerprint, facial recognition)

These factors must be independent of each other so that the compromise of one factor does not affect the reliability of the others.

Application areas

SCA is required in the following cases:

1. access to online payment accounts
2. Initiating electronic payment transactions
3. Performing actions via remote access that involve the risk of fraud or misuse

However, there are exceptions where SCA is not mandatory, e.g. for payments under 30 euros, recurring payments or transactions to trustworthy beneficiaries.

Implementation in practice

The practical implementation of SCA can take various forms:

1. SMS-TAN: One-time password via SMS
2. Push notifications: Confirmation via a banking app
3. Biometric procedures: Fingerprint or facial recognition
4. Chip card reader: Use of a physical card with PIN
5. Token devices: Special hardware for generating one-time passwords

Challenges during implementation

The introduction of SCA presented companies with various challenges:

1. technical complexity: integration of new authentication methods into existing systems
2. User-friendliness: Ensuring a smooth customer experience despite additional security measures
3. Exception management: Correct application and management of SCA exceptions
4. International transactions: Dealing with different standards outside the EU
5. Costs: Investing in new technologies and processes

Impact on various stakeholders

1. banks and payment service providers:
– Implementation of new authentication methods
– Adaptation of risk management systems
– Training of employees and customers

2. online merchants:
– integration of SCA-compliant payment solutions
– potential impact on conversion rates
– adaptation of the checkout process

3. consumers:
– Increased security for online transactions
– Need to familiarize yourself with new authentication methods
– Possible delays or interruptions in online shopping

Significance for the German market

SCA is particularly relevant for the German market:

1. strong e-commerce sector: Germany has one of the largest e-commerce markets in Europe, which underlines the importance of secure online payments.

2. high security standards: German consumers and companies are often particularly security-conscious, which can facilitate the acceptance of SCA.

3. innovation potential: The SCA requirements can serve as a catalyst for innovation in the area of payment technologies.

4. competitive advantage: Companies that implement SCA effectively can use this as a differentiating feature.

Future prospects and trends

The development of SCA is an ongoing process:

1. further development of biometric procedures: Advances in biometrics could lead to even more secure and user-friendly authentication methods.

2. artificial intelligence: AI-based systems could play a greater role in risk analysis and deciding on the need for SCA.

3. integration with other technologies: Linking SCA with blockchain or IoT devices could open up new application possibilities.

4. global harmonization: There could be a movement towards more globally uniform standards for strong authentication.

Conclusion

Strong Customer Authentication is an important step towards improving the security of electronic payments. Although its implementation has brought challenges, it offers long-term benefits in the form of increased security and potentially increased consumer confidence. For companies in Germany, the effective implementation of SCA is not only a regulatory necessity, but also an opportunity to position themselves as a trustworthy and innovative player in digital payments. The continuous further development of authentication technologies will remain an important topic in the future, with the balance between security and user-friendliness representing a key challenge.