{"id":37618,"date":"2020-03-23T10:40:58","date_gmt":"2020-03-23T09:40:58","guid":{"rendered":"https:\/\/archief.betaalvereniging.nl\/?page_id=37618"},"modified":"2021-10-25T14:51:34","modified_gmt":"2021-10-25T12:51:34","slug":"double-verification-of-online-card-payments","status":"publish","type":"page","link":"https:\/\/archief.betaalvereniging.nl\/en\/focus\/roll-out-sca-remote-cards-payments\/double-verification-of-online-card-payments\/","title":{"rendered":"Double verification of online card payments"},"content":{"rendered":"

Mandatory as of 1 January 2021<\/h2>\n<\/div><\/div><\/div>

Issuers<\/a>, acquirers<\/a> and payment service providers (PSPs<\/a>) have to comply with the PSD2<\/a> technical standards for strong customer authentication (SCA<\/a>) of online payments as of 1 january 2021.<\/p>\n

The mandatory introduction of SCA has previously been delayed for more than a year and the EBA and the European Commission have indicated that the COVID-19 crisis does not warrant further extension<\/a>.<\/p>\n<\/div><\/div><\/div><\/div>

Secure two-factor verification<\/h2>\n<\/div><\/div><\/div>

The PSD2 regulations for SCA require almost every online payment to be approved with secure two-factor verification. Only in specific well-defined cases can issuers<\/a> waive this requirement for individual payments.<\/p>\n

\"\"<\/p>\n

It is no longer sufficient for a credit card holder, for example, to approve an online card payment by providing the card number, expiry date and short verification number on the payment card. Henceforth, the cardholder should securely approve every card payment with a combination of something only he or she possesses (such as a personal uniquely identifiable smartphone), something only he or she knows (such as a secret PIN code) or a unique physical characteristic (such as a biometric fingerprint).<\/p>\n<\/div><\/div><\/div><\/div>

SCA Migration Project<\/h2>\n<\/div><\/div><\/div>

To ensure a smooth transition to legally required SCA for online card payments in the Netherlands, the Dutch Payments Association coordinated a migration project for issuers, acquirers and PSPS's: the SCA Migration Project<\/a>.<\/p>\n

The migration project consulted with other stakeholders such as representatives of web shops and consumers, card schemes<\/a> and the Dutch central bank<\/a>. The project kept all stakeholders informed of SCA developments in the payment chain. Unintended adverse effects during the introduction of SCA could thus be avoided.<\/p>\n

The SCA Migration Project has come to a successful conclusion. All participants implemented SCA on time, with minimal disruption to the payment chain for online credit card payments.<\/p>\n<\/div><\/div><\/div><\/div>

EMV 3-D Secure standard for online credit card payments<\/h2>\n<\/div><\/div><\/div>

Online card payments without double verification with SCA are almost always rejected by card issuers from 2021 onwards (unless an individual payment qualifies for exemption). Online merchants or their payment service providers must support SCA for online card payments to ensure the continuity of their payment transactions.<\/p>\n

Online entrepreneurs can contact their PSP or acquirer for advice and help with the application of SCA.<\/p>\n

For most credit card brands, including American Express, Mastercard and VISA, online retailers should support the EMV 3-D Secure (3DS<\/a>) standard for online card payments in order to comply with SCA rules. A PSP<\/a> or acquirer<\/a> can tell exactly what is required to support 3-D Secure.<\/p>\n

With the latest versions of the 3DS standard (3DS v2.x), web shops can benefit from the best possible customer experience with online credit card payments. With 3DS v1.0, however, an online store already meets all the legal requirements for SCA.<\/p>\n

All Dutch issuers fully support EMV 3-D Secure v1.0 as well as v2.x.<\/p>\n<\/div><\/div><\/div><\/div>

Online card payment rejected?
\nContact the merchant!<\/h2>\n<\/div><\/div><\/div>

Consequently, not just credit card issuers but online merchants too should support 3DS, to allow customers to authenticate themselves reliably when making online card payments. In EU web shops that do not yet support 3DS Dutch customers will not be able, in most cases, to succesfully pay online with their credit card. Card issuers (banks) are obliged by law to reject most of those card payments.<\/p>\n

If a customer of web shop cannot authenticate his or her online card payment via 3DS and that payment is therefore rejected, that customer should contact the web shop, not the card issuer. The card issuer (the bank) of that customer can't do anything about this.<\/p>\n<\/div><\/div><\/div><\/div>

Legacy transactions<\/h2>\n<\/div><\/div><\/div>

A legacy transaction<\/a> without SCA will be rejected with a so-called soft decline<\/a> in most cases, unless the payment qualifies for an exemption. Following a soft-decline the merchant can resubmit the payment to the issuer, with 3DS.<\/p>\n<\/div><\/div><\/div><\/div>

SCA exemptions<\/h2>\n<\/div><\/div><\/div>

Dutch issuers support SCA exemptions for low value payment (LVP) and transaction risk analysis (TRA) by the acquirer<\/a> or issuer<\/a>.<\/p>\n

A cardholder needs to perform fewer actions in the case of a payment exempted from SCA. The issuer decides per transaction whether the payment qualifies for exemption from SCA.<\/p>\n<\/div><\/div><\/div><\/div>

Ask your PSP<\/h2>\n<\/div><\/div><\/div>

Web shops and PSPs<\/a> can monitor their conversion ratios and adjust their approach where necessary.<\/p>\n

Obstacles for cardholders can be removed when online card payments fall outside the scope of SCA: a merchant could be eligible to use so-called Merchant Initiated Transactions<\/a> (MITs). SCA does not apply to these transactions. Merchants and PSPs can get more information about MITs from their acquirers.<\/p>\n

\"\"<\/p>\n

 <\/p>\n<\/div><\/div><\/div><\/div>

Glossary<\/h2>\n<\/div><\/div><\/div>

<\/a>Issuer:<\/strong> issuer of payment cards. Most banks issue payment cards to their account holders (both debit and credit cards). There are also specialised issuers of mainly credit cards, such as International Card Services (ICS) in the Netherlands.<\/p>\n

<\/a>Acquirer:<\/strong> Institution that receives card payments on behalf of companies and organisations where customers can pay by debit or credit card. The larger banks offer this service but specialists such as Worldline also offer it.<\/p>\n

<\/a>PSP:<\/strong> Payment service provider. Provider of various payment services to merchants. For example, a PSP operates between various acquirers and web shops and handles all or part of the electronic payment traffic for those web shops, for multiple online payment methods.<\/p>\n

<\/a>Card Scheme:<\/strong> the rules and agreements for the payment cards of a certain brand with which issuers and acquirers must comply. The Dutch are most familiar with the schemes of Maestro and V PAY for debit cards and of American Express, Mastercard and VISA for credit cards.<\/p>\n

<\/a>PSD2:<\/strong> Revised Payment Services Directive, the most recent legal directive for payment services in the European Union. One of the provisions in PSD2 is that, in principle, all electronic payments must be approved by customers with SCA.<\/p>\n

<\/a>SCA:<\/strong> strong customer authentication, double verification or two factor authentication. Under PSD2, essentially all electronic payments must be approved by customers with SCA. In practice, this means that the customer must approve a payment using a combination of two secure and independent factors, such as, for example, a personal bank card combined with a secret PIN code. Or, for example, a registered app on a personal smartphone combined with a unique fingerprint.<\/p>\n

<\/a>EMV 3-D Secure of 3DS:<\/strong> An industry technical SCA standard for most online card transactions. EMV used to stand for Europay, Mastercard and VISA, three occidental schemes for card payments. Europay no longer exists and nowadays EMV stands for the industry technical standards for payment cards from all leading card schemes, anywhere in the world. 3DS is the EMV standard for secure online card payments with SCA.<\/p>\n

<\/a>Legacy Transaction:<\/strong> credit card payment the old way, without strong customer authentication (SCA).<\/p>\n

<\/a>Soft Decline:<\/strong> the rejection by an issuer of an online card payment that does not meet the requirements of SCA (legacy transaction). The online store can then offer this payment to the issuer w\u00edth SCA.<\/p>\n

<\/a>Merchant Initiated Transaction (MIT):<\/strong> payment offered by the accepting party (such as an online store) to the issuer without the involvement of the customer (the card holder). This is possible, for example, if the merchant is authorised in advance by the card holder to make the payment at a later time. It is a kind of direct debit for payment cards, especially useful for monthly automatic payment of subscriptions or for making the customer pay after an order has been shipped.<\/p>\n<\/div><\/div><\/div><\/div><\/div>","protected":false},"excerpt":{"rendered":"

Issuers, acquirers and payment service providers (PSPs) have to comply with the PSD2 technical standards for strong customer authentication (SCA) of online payments as of 1 january 2021.<\/p>\n","protected":false},"author":8,"featured_media":37034,"parent":35711,"menu_order":1,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-37618","page","has-post-thumbnail","hentry"],"_links":{"self":[{"href":"https:\/\/archief.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/pages\/37618","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/archief.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/archief.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/archief.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/archief.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/comments?post=37618"}],"version-history":[{"count":11,"href":"https:\/\/archief.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/pages\/37618\/revisions"}],"predecessor-version":[{"id":44314,"href":"https:\/\/archief.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/pages\/37618\/revisions\/44314"}],"up":[{"embeddable":true,"href":"https:\/\/archief.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/pages\/35711"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/archief.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/media\/37034"}],"wp:attachment":[{"href":"https:\/\/archief.betaalvereniging.nl\/en\/wp-json\/wp\/v2\/media?parent=37618"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}