Preparing for SCA: Here’s How the Payments Industry Can Take Control
Strong Customer Authentication (SCA) is set to be the most significant change to how people pay for things, not only online but also for card-present retailers across Europe. Even though the rules on SCA officially commenced on 14 September 2019, retailers have been granted additional time with the deadline being pushed back further, this time to March 2022. This is now the third time the deadline for retailer compliance has been pushed back, which raises the question, will SCA ever really take off?
Well, for retailers the extended deadline has no doubt been a welcome announcement from the FCA for a number of reasons, predominantly because it gives organisations a little more time and breathing space to adapt their authentication and verification tools. But it’s also a benefit for banks and payment providers too.
The ongoing delay to the SCA will give the payments industry extra time to prepare for the rollout of the directive so they can deliver a secure payment option to consumers. If the payment ecosystem fails to use this time to prepare or implement the right technology to comply with this new ruling, it will open consumers up to a significant threat of card fraud.
The main challenges facing retailers
There has been a large amount of focus on the implications of SCA when shopping online; however, face-to-face purchases will also need to be revisited. Even when using a card physically, SCA will require two-factor authentication for every purchase made over the contactless limit. This additional layer of protection provides a more stringent authentication process that will help to keep millions of accounts safe from both traditional fraudsters and cybercriminals.
Two-factor authentication means that not only will the user need to provide their details when making a purchase, they’ll also have to confirm their identity with:
- something they know (a PIN or password)
- something they have (such as a smartphone)
- or something they are (biometric face or voice features or a fingerprint).
Once implemented, this will be beneficial in protecting consumers, however, getting to this stage will be a challenge. The requirements are set to cause widespread disruption to the retail space. The introduction of SCA will require in-person merchants and card issuers as well as online Payment Service Providers (PSPs), such as PayPal and WorldPay, to have in place the technical enhancements and testing needed by the deadline.
The importance of educating the consumer on SCA
This presents a significant logistical challenge; maintaining effective fraud prevention while keeping an optimised customer experience is not easy. But perhaps the biggest challenge of all is that consumers themselves still aren’t entirely aware of SCA or what will be expected of them come March.
The introduction of SCA demands collaboration within the industry to educate consumers, but ultimately it is up to payment providers to provide a reliable, secure and SCA-approved method of payment to consumers. Providers must also ensure that the method they choose is not only up to standard but is affordable and accessible to all.
Preparation is the key to secure payments
So, how does the market get ready for the roll-out of the ruling between now and the new deadline of March 2022?
Over the coming months, retailers and banks should be open and transparent with customers to minimise the risk of unexpected disruption to payments. To provide this level of communication, retailers need to educate themselves regarding the issues and requirements needed to ensure they are SCA compliant. Security measures must also be put in place to comply with the SCA requirements sooner, rather than later.
Biometric payment cards also offer the answer for payment providers to help prepare for SCA. Not only will these cards – with inbuilt fingerprint sensors to verify ownership – provide strong customer authentication, but they also come with the added benefit of convenience. Validating your payment with a fingerprint speeds up the transaction process and removes the requirement of PINs or the use of a smartphone.
Already, it is worth noting that some payment card manufacturers, such as IDEMIA, are already preparing biometric payment card solutions. These will be ready for banks and card issuers to adopt so they have the time they need to pilot and roll out the new payment method before the new SCA deadline is imposed.
The FCA has also outlined previously that long-term authentication through biometrics and mobile app-based solutions is the future of secure payments. Biometric payment cards meet the standards of SCA regulation required to enable safer transactions whilst also providing a speedy and easy way for consumers to shop safely. With more consumers now shopping online than ever before, it is imperative that card issuers, payment providers, online retailers – as well as in-store merchants – act now to prepare for the regulation.