Since the birth of the internet, online sales have grown steadily, but this growth has always gone hand in hand with a certain lack of trust when it comes to paying in online shops. That is why a new security measure called PSD2 has been introduced: a European regulation that will help raise security levels and, in turn, increase trust in online payments.

WHAT IS PSD2 AND HOW DOES IT AFFECT YOUR BUSINESS?

PSD2, the Payment Services Directive, is a new European Commission directive (EU) 2015/2366 and the evolution of the PSD that began in 2007.

Its main aim is to help improve the security of electronic payments and support the entry of new players into online commerce, preventing potential fraud in ongoing transactions. Although it affects any business that sells products online, those that have to adapt to the regulation are online sales platforms, payment gateways and banks' payment methods.

As with any new technology, there is an adaptation period, which raises questions in e-commerce related to the implementation of the 3DS protocol. This protocol has been in use for several years, and the biggest drawback of this technology is a drop in sales. Adding steps to the payment process can lead shoppers to abandon a purchase, and a good customer experience is essential to winning sales.

The new 3DS v2 update uses more data and requires strong customer authentication (SCA) to make payments more secure and faster than ever. The only complexity lies in implementing SCA.

SCA, TWO-FACTOR AUTHENTICATION

The new SCA regulation is designed to help reduce fraud, ensuring maximum security when making online payments or logging in to bank accounts. It requires two-step verification: customers must use at least two of these 3 forms of authentication to make a payment or transaction:

1. Something the customer knows, such as a password or PIN code.
2. Something the customer has in their possession, such as their mobile phone or bank card.
3. Something that personally identifies the customer, such as their fingerprint or facial recognition.

Although at first it may cause some purchases to be abandoned before completion, over time it will benefit all internet users.

EXEMPTIONS UNDER PSD2

Although businesses will have to adjust their payment processes to accommodate this enhanced two-factor authentication, the regulation includes exemptions that can spare most payments from this step. They are as follows:

• Payments under 30 euros. Purchases under 30 euros do not require two-factor authentication. This can lighten the load for many transactions, but it is not quite that simple. After every five payments under 30 euros, or when these small payments add up to more than 100 euros, the customer's bank must require strict identity verification.

• Telephone payments. When paying by phone, that is, when the customer calls a switchboard and authorises the payment, this identification requirement does not apply.

• Recurring payments or payments initiated by the business. This is undoubtedly one of the exemptions that can benefit businesses the most. Whether it is gym fees, after-school activities, newspaper subscriptions or travel cards, all recurring payments are exempt from two-step verification. The same applies when the business, rather than the customer, initiates the payment, such as when the customer saves their card details in the merchant's app or website. If customers are already registered on the website, they do not need to verify the payment every time they make a purchase, but they will have to complete an enhanced identification process when entering their details for the first time.

• Trusted businesses. This exemption is particularly beneficial for customers, as they can tell their bank that they consider a business "trusted", so any transaction with it does not require two-step verification.

• Low-risk transactions. By analysing common fraud rates, payment providers can flag certain transactions as "low risk". In these cases, two-step verification is not carried out. As with any other exemption, the cardholder's bank ultimately decides whether to approve or decline the payment without further verification.

Sources: www.visa.es
mastercard.com