Payment Services Directive (PSD2)

Strong Customer Authentication (SCA)

A Foundation for PSD2 Compliance.

A key PSD2 requirement is Strong Customer Authentication (SCA). Because usernames and passwords don't provide sufficient security, the new directive calls for two-factor authentication for all electronic transactions. Our authentication solutions help you enable your PSD2 requirements – and they ensure a transparent and frictionless user experience.

Below are the key elements required to create strong customer authentication.

Two-Factor Authentication (2FA)

The use of two independent authentication methods is mandated. If one of the methods involves a smart phone or other mobile device, security measures are required to ensure that the device being used has not been compromised. Entrust Datacard offers the widest range of authenticators, so you can offer your customers the one that that works best for them.

Transaction Monitoring & Fraud Protection

PSD2 mentions the need for transaction monitoring software that analyzes risk as transactions are taking place. Our solutions — including Entrust™ Transaction Guard — enable fraud prevention tools with adaptive capabilities. Factors such as payment amounts, known fraud scenarios, payer/payee locations and device reputation are used to allow, challenge or stop transactions.

Dynamic Linking

Hackers have learned to insert themselves into the middle of legitimate electronic transactions after they’ve been initiated — which has created the need for dynamic linking. Entrust Datacard solutions link authentication codes to specific transaction amounts and payees. If either the amount or the payee changes during a transaction, a new code is issued. Our solution — which can feature OTP codes, mobile push notifications or other authenticators — also provides highly secure transactions.

Runtime Application Self-Protection (RASP)

The proliferation of mobile payment apps creates new opportunities for hackers. RASP is a suggested protocol for detecting anomalous app behavior and blocking the app from executing any further operations. Our RASP solution hardens the mobile app code and allows it to defend itself at runtime. This safeguards against hacking and reverse engineering. Also, with our Entrust IdentityGuard client-side software, the apps or SDKs act only on requests from the server. If a fraudulent entity tries to fool the app into signing a transaction, the transaction verification fails.

The Secure Communications (SC) Requirement

Another key PSD2 requirement is Secure Communication (SC). PSD2 Qualified Website Authentication Certificates (QWACs) form the highest level of authentication and will be required to secure the Open Banking APIs used for transferring private data when making a payment or transferring money. They are meant to bring greater transparency, accountability and authentication to users in the EU marketplace.

Our QWACs Secure Communication solution enables PSD2 compliance, while providing greater transparency, accountability, and authentication to users in the European Union marketplace.

Establish Trust for Secure Communications

PSD2 requirements expand upon existing verification requirements for third-party providers requiring them to purchase specialty SSL/TLS certificates known as PSD2 QWACs. These certificates provide the highest level of assurance and the most robust foundation of trust available for securing sensitive transactions.

Encrypt Communications

Strong encryption coupled with high assurance provide third-party service providers and users a high degree of confidence when transferring sensitive data online. The PSD2 QWACs provided by Entrust Datacard use: RSA Encryption Algorithm, SHA-2 Hashing Algorithm, and a minimum key size of 2048 bits — all of which meet or exceed the minimum requirements for encrypting online transactions.

Balancing PSD2 Data Sharing Requirements with GDPR Guidelines

These two critical initiatives seem to be at odds. PSD2 advocates for sharing customer data, while GDPR promises severe financial consequences for organizations that violate consumer data privacy regulations. While it seems there will be more direct guidance coming from governing bodies in the future, banks must — for the time being — balance both requirements using their best judgement. This means that banks should avoid a separate or siloed approach to their GDPR and PSD2 implementations. Approach them as a unified initiative and develop a single framework that simultaneously makes customer data available, yet protects that same data from being compromised by hackers. For help with this important balancing act, contact an Entrust Datacard trusted identity expert.

Consult with an Expert