Trending: How does PSD2 trigger innovation?

Transcription

1 Trending: How does PSD2 trigger innovation? Speakers: Nils Jung, Managing Partner, Innopay Germany Hakan Eroglu, Senior Manager Digitization in Payments & Banking, Accenture

2 Trending: How does PSD2 trigger innovation? Nils Jung, Managing Partner Innopay Germany

3 SCA shall ensure customer protection via an increased level of security of electronic payments IN WHICH DOES SCA NEED TO BE SELECTED? When a customer accesses their payment account online (incl. an aggregated view of their payment accounts). When making an electronic payment. When carrying out any action through a remote channel which may imply a risk of payment fraud or other abuses. Payment Service Providers are allowed to apply exemptions in the application of SCA in certain cases. Source: EC; Innopay Analysis

4 At least two of the three verification items need to be available to grant access in an SCA compliant manner WHICH ITEMS NEED TO AVAILABLE TO GRANT COMPLIANT ACCESS? KNOWLEDGE Element only the user knows (PIN, password ) POSSESSION Something only the user possesses (a card, a mobile phone ) INHERENCE Something the user is (iris or voice recognition, biometric identification like fingerprint, ). Verification least by TWO of these items Source: EC, Innopay Analysis ACCESS

5 The RTS lists a number of possible exemptions, to keep electronic payments as convenient and seamless as possible WHICH SCA EXEMPTIONS CAN BE SELECTED? CHANNELS IN SCOPE OF SCA SCA EXEMPTION SUMMARY FOR ELECTRONIC PAYMENTS Online Internet Banking Debit / Credit Card present Mobile Banking Card Not Present CHANNELS OUT OF SCOPE OF SCA Mail Order and Telephone Order* Payee Initiated transactions Transaction Risk Analysis (Art 18) Secure corporate payments (Art 17) White lists of trusted beneficiaries (Art 13) Recurring transactions (Art 14) Low-value transactions (Art 16) up to 30 with no counter limitation up to 100 if fraud rate <13 bps up to 250 if fraud rate <6bps up to 500 if fraud rate <1bps <30 EUR - with counter limitation Selection of exemption options based on: Risk Management ability Client Demand / Expectations Corporate Strategy Processual / Operational ability One Leg Transactions ** Anonymous prepaid cards Credit transfers between accounts held by the same natural or legal person (Art 15) Source: EC, Innopay Analysis

6 Fraud and risk management capabilities of the PSP are a core element to deal with SCA requirements DETECTION MEASURES FOR UNAUTHORISED OR FRAUDULENT PAYMENT TRANSACTIONS? NO SCA IF ELECTRONIC TRANSACTION IS POSING A LOW LEVEL OF RISK, IF: Lists of compromised or stolen authentication elements Amount of each payment transaction Known fraud scenarios in the provision of payment services Minimum required transaction monitoring mechanisms for PSPs 5 Signs of malware infection in any sessions of the authentication procedure Abnormal use of the access device etc. Additional fraud monitoring capability to make use of the exemptions from Article18 1. Fraud rate for that type of transaction is equivalent to or below the reference fraud rates 2. Amount of the transaction does not exceed the relevant Exemption Threshold Value ( ETV ). 3. Real-time transaction monitoring have not identified: abnormal spending or behavioral pattern of the payer; unusual information about the payer s device/software access; malware infection in any session of the authentication procedure; known fraud scenario in the provision of payment services; abnormal location of the payer; high risk location of the payee. 4. Risk score of a transaction based on: previous spending patterns of the individual payment service user; payment transaction history of each of the payment service provider s payment service users; location of the payer and of the payee at the time of the payment transaction in cases where the access device or the software is provided by the payment service provider; identification of abnormal payment patterns of the payment service user in relation to the user s payment transaction history. Source: EC, Innopay Analysis

7 Offering the best and innovative customer experience under RTS /SCA requires a strategic decision of the PSP How to offer best customer experience under RTS / SCA requirements? Make use of exemptions Mix of both possible Make SCA seamless AREA OF INNOVATION 1 Innovate in Fraud/Risk management 2 Integrate further processual / UX requirements for exemptions 3 Innovate in Authentication Technology Source: Innopay Analysis

8 FRICTIONLESS PSD2 HOW BIOMETRICS CAN HELP BANKS BALANCE CONVENIENCE, COMPLIANCE AND SECURITY HAKAN EROGLU,

9 LEGAL NOTICE Accenture is a global provider of professional information technology solutions and services, providing a broad range of services and solutions in strategy, consulting, digital, technology and operations. Views and opinions expressed in this document are based on Accenture s knowledge and understanding of its area of business, markets and technology and are provided for consultation purposes only. This document is not comprehensive, does not contain legal advice or interpretation of any legal or regulatory requirements applicable to such areas, including, for example, PSD2, RTS, GDPR, and its full impact on such documents has not been considered. The reader must rely on their legal representatives to interpret any legal/regulatory requirements applicable to the subject matter of this document or determine whether this document is compliant with them. 9

10 HOW PSD2 AND RTS CHANGE THE GAME IN PAYMENTS Online payments to an e-merchant or other beneficiary direct from the payer s bank account New services that aggregate and analyze customer payment account information New security requirements for electronic payments and account access through authorisation & authentication obligations and customer consent management Copyright 2017 Accenture All rights reserved

11 FRICTIONS IN CUSTOMER EXPERIENCE PSD2 RTS on Strong Customer Authentication (SCA) mandates 2-factor authentication, using two or more of three elements for authenticating a payment or granting access to account information: KNOWLEDGE POSSESSION INHERENCE SOMETHING YOU KNOW PIN, password SOMETHING YOU HAVE Token, smartphone TODAY S SCA METHODS BASED ON KNOWLEDGE AND POSSESSION ARE MOSTLY INCONVINIENT SOMETHING YOU ARE A biometric characteristic 11

12 THE CHALLENGE: BALANCING SECURITY WITH CUSTOMER EXPERIENCE Strike the right balance between RTS- COMPLIANCE FRICTIONLESS CUSTOMER EXPERIENCE ROBOST FRAUD MANAGEMENT Those offering the best customer experience will win out. 12

13 POSSIBLE SOLUTION: MULTI-FACTOR AUTHENTICATION (MFA) USING BIOMETRICS FOR INHERENCE Choosing the right elements for MFA is difficult: What a user possesses can be lost, duplicated/stolen; What a user knows can be shared or assumed What a user is or does is unique to him or her So choosing Biometrics as one of the factors in MFA can address the shortcomings of other means of authentication Biometrics scores highly on convenience, offers lower processing costs, and can enable banks to differentiate themselves. 13

14 THE DRIVERS FOR BIOMERICS IN MFA FUELED BY CUSTOMERS DEMAND FOR A SEAMLESS EXPERIENCE CUSTOMERS WANT BIOMETRICS 85% of customers are frustrated with usernames and passwords YET KNOWLEDGE GAPS ARE SLOWING ADOPTION Sources: Mastercard, Gartner research. 36% of decision makers have the adequate skills 93% of people prefer biometrics to passwords BANKS ARE ENTHUSIASTIC, TOO 92% of banks want to adopt biometrics CUSTOMERS ARE READY FOR BIOMETRICS 500 MILLION Biometric sensors globally by

15 BIOMETRIC MODALITIES Fingerprint Face Recognition Iris Recognition Voice Recognition Vascular Recognition Behavioural Biometrics 15

16 BIOMETRICS SOLUTIONS NEED TO BE RTS COMPLIANT Biometrics solutions must meet the same RTS requirements on SCA as existing less convenient authentication methods. This means meeting five high-level criteria: DYNAMIC LINKING The authentication code generated through the SCA must be specifically linked with the amount paid and the payment recipient, and shown to the payer. INDEPENDENCE OF CHANNELS The channel used for the payment initiation or account information must be separate from the channel used for the authentication code. CREATION AND VALIDATION WITHIN BANK S ENVIRONMENT The creation and secure submission of the PSU security credentials must be performed within bank s secure environment. UNDERIVABLE AUTHENTICATION CODES Authentication codes must not give any indication about the other authentication elements and their mechanisms. NON- DISCLOSURE Security credentials must not be stored in plain text, and cryptographic materials must be protected from unauthorized disclosure. Regulators are leaving it open to the market to come up with standards for RTS compliance and evaluation. The FIDO Alliance is aiming to adapt its framework to comply with RTS. 16

17 EXISTING SCA METHODS ARE LACKING SECURITY OR CONVENIENCE 17

18 FRICTIONLESS PAYMENTS IS KEY Behavioral Biometrics is the new standard Low / Medium Risk Transactions BEHAVIORAL BIOMETRICS including: Dynamic signature verification examining dynamics such as the speed, direction and pressure in an individual s signature. Keystroke dynamics examining dynamics such as speed and pressure in an individual s keystrokes. Voice recognition using vocal characteristics to identify individuals using a pass-phrase. Additional Checks for High-Risk Transations or Customer not recognized VISUAL BIOMETRICS using five characteristics. Facial recognition the spatial geometry of the face. Fingerprint using the ridges and valleys on the surface tips of the finger. Finger-vein using the finger veins below the skin Hand/finger geometry measuring many dimensions of the hand and fingers. Eyes including iris recognition and retina recognition. 18

19 BIOMETRIC AUTHENTICATION IS ALREADY HERE: EXISTING USE CASES IN BANKING AND PAYMENTS Large grocers and other retailers are using frictionless commerce, where customers walk into the store, are recognized using technologies such as face recognition, and make the payment invisibly as they walk out. Mobile transactions or customer services can be secured through voice or speech recognition. IN-STORE WITH INVISIBLE PAYMENTS MOBILE BANKING = BIOMETRICS INTERNET BANKING BRANCH BANKING BANKING ATMs Using fingerprint and finger vein biometrics for customer identification and transaction authentication in branches. Usage of biometrics in banking ATMs is growing in developed countries. Many computers, laptops and even smartphones have webcams, microphones, and fingerprint scanners built in. 19

20 OUR LATEST THINKING AVAILABLE AT ACCENTURE BOOTH #18 20

21 THANK YOU HAKAN EROGLU Europe Thought Leadership Payments ASGR Open Banking & Digital Ecosystems Lead Senior Manager Office Zurich