Community
Risk professionals and retail leaders for months have been fixated on the new strong customer authentication (SCA) requirements that arrived with PSD2 — and rightfully so.
The new payments regulation, set for enforcement in the UK in March 2022, is a once-in-a-generation change with the potential to massively disrupt an enterprise or to push an enterprise ahead of its competitors when it comes to customer experience.
But while SCA itself will be a vital pillar of protection for merchants and consumers alike, there is more to fraud and more to fraud protection than simply deploying an SCA solution. It is not, as some have mistakenly assumed, the only fraud solution a merchant will ever need, and one only need to look to the European countries where enforcement has begun in order to understand the limits of SCA’s fraud protection.
Many transactions are not subject to SCA, and whilst this is a saving grace for merchants who are worried about online customer experience, it means they will still be vulnerable to fraudsters who will inevitably target the transactions which are exempt from this added SCA layer. Merchants should also consider the fact that a low-fraud rate will be vital for providing a top-notch customer experience once SCA is enforced, and this is only possible by ensuring they have the most robust defenses in place.
SCA calls for a more robust authentication
The promise of SCA is that it will better protect consumers by routing many transactions through 3D Secure and requiring two-factor authentication that calls for a shopper’s identity to be confirmed through two of the following: something the user knows (like a one-time passcode); something the user has (like a mobile device); and something the user is (fingerprint, facial recognition, typing behaviour).
Notably, there is nothing stopping fraudsters from attacking transactions protected by 3D Secure alone — and they do. The security protocol does shift liability from the merchant to its bank, but if a bank is hit by fraud often enough, it will protect itself by declining more orders.
That’s SCA in simple terms but the wonder of the regulation lies in the detail. And on closer inspection of what SCA stipulates, it is clear that a robust fraud protection solution will be the bedrock of a merchant’s successful SCA strategy because:
Let’s start with exemptions, as they are the key to providing a seamless SCA experience for online customers. Exemptions allow orders to be approved without undergoing SCA based on the notion that the transaction isn’t very risky or wouldn’t be very costly if things go wrong.
Skipping SCA is a highly desirable outcome as stricter authentication measures have the potential to disrupt the customer’s online checkout experience. A recent study into European markets where SCA is already being enforced found basket abandonment rates of 25% and higher by country. Much of the friction leading to those horrid abandonment rates is caused by merchants relying on an outdated version of 3D Secure. The newer version 2.2 is expected to yield big improvements.
Why require customers to confront SCA when they don’t have to?
Nonetheless, why put a customer through two-factor authentication when it’s not necessary and when customers don’t like being inconvenienced? In a recent consumer survey, more than 37% of UK consumers said they’d been unable to complete a transaction because of new online security procedures. Moreover, more than 46% said they were very or somewhat likely to give up on transactions that require two-factor authentication.
And so, exemptions. The important thing to remember about exemptions is that a low fraud rate is the price of admission. Let’s break the exemptions down and consider the role of best-in-class fraud protection in making them possible and secure:
Exclusions provide another set of circumstances to avoid SCA
Beyond exemptions, there are a host of scenarios under which SCA does not come into play, which leaves merchants vulnerable to fraud unless they have a solution in place. We live in a global economy. We live in a time when consumers shop the way they want to shop when they want to shop.
The new SCA regulations apply to merchants within the European Economic Area. But not all customers who shop with merchants in the EEA live in the EEA. Their purchases are subject to an SCA exception known as the “one leg out” exclusion. If either the issuing or acquiring bank involved in a transaction is outside of the EEA, SCA does not apply. Therefore, those orders are protected only by whatever fraud solution the merchant has in place.
Certain types of orders — mail order and telephone — are not subject to SCA, meaning the next call-in order a retailer gets could well be from a fraudster. Transactions made with anonymous payment instruments — think prepaid gift cards — are not subject to SCA. Guess who just became big fans of prepaid gift cards?
Friendly fraud spiked dramatically during the COVD-19 pandemic
Finally, consider the challenge of non-payments fraud, sometimes called friendly fraud. The Consumer Abuse Index ended 2020 at a level five times what it was before the COVID-19 pandemic set in. Another measure of the increase in friendly fraud was evident in the aforementioned consumer survey. More than 36% of UK consumers surveyed said they’d falsely claimed that a legitimate charge on their credit account was fraudulent. Just over 30% admitted to falsely claiming that an order never arrived or that an order was unsatisfactory when it did arrive. Two months before the pandemic began, only 14% of respondents said they had falsely claimed that a package had never arrived or that it arrived in poor condition.
Obviously, SCA is not going to detect friendly fraud, and retailers will need additional solutions in place.
Fraud rates and risks vary by retailer and even by retail vertical. But as SCA rolls across Europe and becomes enforced in the UK, it is clear that the new regulation is not a be-all fraud solution and merchants will need to consider other fraud solutions to protect their business and maintain an excellent customer experience online.
This content is provided by an external author without editing by Finextra. It expresses the views and opinions of the author.
Alexander Boehm Chief Executive Officer at PayRate42
02 September
Alex Kreger Founder & CEO at UXDA
Azimkhon Askarov Co-partner at CONCRYT
Edvards Margevics Co-partner at CONCRYT
30 August
Welcome to Finextra. We use cookies to help us to deliver our services. You may change your preferences at our Cookie Centre.
Please read our Privacy Policy.