PSD2: strong authentication to secure your online transactions
The second European Payment Services Directive, known as PSD2, governs payments and sensitive transactions carried out remotely. It has a twofold aim: to strengthen the security of online transactions through strong authentication, and to promote competition and transparency between payment service providers.
What is strong authentication?
To validate a sensitive transaction, such as an online payment or access to a personal area, the provider must verify your identity using at least two independent elements from three categories:
- Something you know: a password, a confidential code, the answer to a secret question.
- Something you have: a mobile phone, a card, a card reader, an authentication app.
- Something you are: a fingerprint, face recognition or voice recognition.
These elements are independent: the compromise of one of them must not undermine the reliability of the others.
When is it required?
- For an online electronic payment, above certain thresholds or cumulative amounts.
- When accessing a payment account or a secure personal area.
- For any remote transaction that may involve a risk of fraud, such as changing a payee or a payment limit.
The regulations provide for exceptions, in particular for certain low-value payments, for trusted payees that you have registered yourself or for recurring payments of the same amount. The provider remains free to apply strong authentication even where an exception is possible.
What PSD2 changes for you
- Increased security: a fraudulent transaction becomes harder to carry out with the mere theft of a password or a card number.
- Regulated liability: if you report an unauthorised transaction without delay, the law in principle limits your liability, unless you acted fraudulently or with gross negligence, for example by disclosing your codes.
- New services: with your consent, authorised providers can view your accounts or initiate a payment on your behalf. You can withdraw this consent at any time.
And on this website?
This website is for information and simulation purposes: it does not allow you to make payments or carry out transactions on an account. If services of this kind were ever offered, they would be subject to the requirements of PSD2. To learn how to recognise scam attempts, see our Credit fraud page.
