Important PSD2 and SCA Requirements For Online Merchants

Secfense meta 2a

PSD2 and Strong Customer Authentication

PSD2 and Strong Customer Authentication continue the shift in the online payment landscape in Europe. The next big change comes in January 2021. This article will explain what changes to expect and how to prepare for them.

PSD2 stands for the Payment Services Directive 2. The term was designed by the European Commission to regulate online transactions in Europe.

One of the key requirements of the PSD2 directive is related to Strong Customer Authentication. This requirement will become mandatory for all electronic transactions in the European Union starting in January 2021.

SCA has evolved from the existing 3-D Secure protocol standard developed by the card producers to protect online credit card transactions against fraud. Each vendor has its own name for it.

Services based on the 3-D protocol have different names such as:

  • Verified by Visa
  • SecureCode by MasterCard
  • Safe Key by American Express
  • ProtectBuy by Discover
  • J/Secure by JCB International

Strong Customer Authentication requires cardholders to authenticate themselves with at least two factors out of the following three.

  • something they know – a PIN or a password
  • something they have – a card reader or a mobile phone
  • something they are – voice recognition or a fingerprint scanner

Therefore SCA, a newer version of 3-D Secure, is meant to provide a safer online experience and protect customers against card fraud risks. With SCA the cardholders are no longer able to make an online purchase using only the information on their cards, such as CVV or the card number. From January 2021 online customers will have to verify their identity for example with the bank app (something that they have) and a password (something that they know) or a fingerprint (something that they are) to approve the purchase.

What will the SCA and PSD2 change mean for online merchants?

Until now, it was the decision of the merchant if the 3-D Secure protocol should be used or not. With the new directive that will become binding by January 2021, it is now the issuer who will decide to present authentication in the authorization process. One of the core differences in version 2 is that the issuer can use a lot of data points from the transaction to determine the risk of the transaction. For example, the IP address, the browser information, the cardholder details, etc.

Strong Customer Authentication introduces two flows:

  • The frictionless flow
  • The challenge flow

Frictionless is meant for low-risk or low-value transactions. The issuers will not challange the transactions. The authentication is done in the background and is invisible to the cardholder. This provides a more seamless experience for the customer.

Challenge is for high-risk transactions. If the data provided by the customer is not sufficient, the issuer will require the cardholder to be authenticated. In this situation, an additional authentication request will be added in the checkout process.

How should merchants prepare for the SCA and PSD2?

  1. 3-D Secure implementation
    It is crucial to implement 3-D Secure as soon as possible. If it’s not done by the end of 2020, the European issuers will decline transactions that don’t meet the PSD2 requirements.
  2. Additional customer data
    It’s also important to submit additional data to the issuer in order to maximize the chance that frictionless flow will be dominant. The additional data can be the cardholder’s name, email address, phone number, shipping location, and billing addresses or information about previous orders.
  3. Implement fraud detection
    The last thing is to start using fraud detection. The data, already collected for 3-D Secure, is also extremely useful for fraud prevention tools. Risk management algorithms are based on statistics of past behaviors as well as individual merchants’ or consumers’ data.  As a merchant, you can improve your credibility by consistently sending reliable transactions. This will increase your chances to be considered a safe partner and enable frictionless flow for the future.

How can Secfense help to prepare for the PSD2 deadline?

As you see the PSD2 directive and SCA is strongly related to strong authentication. The online payment-related directive requires cardholders to authenticate themselves with at least two factors. Online merchants have little time to introduce strong authentication mechanisms in order to comply with the new law.

The traditional strong authentication deployment process requires software development. The online application that is supposed to be equipped with two-factor authentication needs to be redesigned by software developers so it can work with a new authentication standard. This software development work is usually time-consuming, expensive, and complicates the everyday operations of the company.  

Secfense has developed a solution called User Access Security Broker that is meant to make a strong authentication adoption process smooth and easy. The broker makes it possible to deploy any method of strong authentication without touching a protected application code. No software development work is required. Additionally, the security admin has the ability to switch between authentication methods as many different authentication methods are available in the admin dashboard. At any time the administrator can deploy, switch on, and off strong authentication on any web application within the company. This gives independence, comfort, and security that was not possible before when traditional deployment mechanisms were introduced. To learn more about the Secfense broker please visit our solution site.

Antoni takes care of all the marketing content that comes from Secfense. Read More


We are faced with new challenges every day. We must always be one step ahead of the attackers and know what they are going to do before they do it. We are convinced that the User Access Security Broker will bring security to a new level, both for those working at the office and from home. For us, working with Secfense is an opportunity to exchange experience with developers who put great value on out-of-the-box thinking.

Krzysztof Słotwiński

Business Continuity and Computer Security Officer

BNP Paribas Bank Poland

As part of the pre-implementation analysis, we verified that users utilize a wide range of client platforms: desktop computers, laptops, tablets, smartphones, and traditional mobile phones. Each of these devices differs in technological advancement, features, and level of security. Because of this, and also due to the recommendation of the Polish Financial Supervision Authority (UKNF), we decided to introduce additional protection in the form of multi-factor authentication mechanisms based on FIDO. As a result, users of our applications can log in safely, avoiding common cyber threats such as phishing, account takeover, and theft of their own and their clients’ data.

Marcin Bobruk



We are excited to partner with Secfense to enhance our user access security for our web apps. By integrating their User Access Security Broker, we ensure seamless and secure protection for our applications and systems, delivering superior security and convenience to our customers.

Charm Abeywardana

IT & Infrastructure

Visium Networks

Before investing in Secfense, we had the opportunity to talk to its existing clients. Their reactions were unanimous: wow, it’s so easy to use. We were particularly impressed by the fact that implementing their solution does not require the involvement of IT developers. It gives Secfense a huge advantage over the competition, and at the same time opens the door to potential customers who so far were afraid of changes related to the implementation of multi-factor authentication solutions.

Mateusz Bodio

Managing Director


Even when the network and infrastructure are secured enough, social engineering and passwords can be used to gain control of the system by attackers. Multifactor authentication is the current trend. Secfense addresses this and allows you to build zero trust security and upgrade your current systems to passwordless applications within minutes, solving this problem right away,” said Eduard Kučera, Partner at Presto Ventures and cybersecurity expert – former Director in hugely successful Czech multinational cyber security firm Avast.

Eduard Kučera


Presto Ventures

One of the biggest challenges the world is facing today is securing our identity online. That’s why we were so keen to have Secfense in our portfolio. They make it possible to introduce strong authentication in an automated way. Until now, organizations had to selectively protect applications because the deployment of new technology was very hard, or even impossible. With Secfense, the implementation of multi-factor authentication is no longer a problem, and all organizations can use the highest standards of authentication security.

Stanislav Ivanov

Founding Partner

Tera Ventures

Two-factor authentication is known to be one of the best ways to protect against phishing; however, its implementation has always been difficult. Secfense helped us solve that problem. With their security broker, we were able to introduce various 2FA methods on our web applications at once.

Dariusz Pitala

Head of IT