All data which are used as part of a security control, if abused could be potentially used to initiate a fraud. Examples of such data are: Mobile phone (it is used to send an SMS OTP to the PSU or the Soft Tokens App which generates the OTP), address (it is used to disseminate the PSCs), email (it is used to either send an OTP or transaction details) and fax instructions for payments transfers.
We consider the following possession elements as appropriate:
• hardware token: PSU has physical access on the device itself, in certain cases PSU is using a PIN to unlock the device
• software token (mobile app): PSU has physical access on the device itself and is using a PIN (or the TouchID) to unlock the device
• Email OTP: PSU has access on his email
• SMS OTP: PSU has access on his device to get his SMS OTP
• Digital signature (stored on an appliance hosted by the PSP): PSU has a PIN to unlock his digital signature.
• Biometric Signature obtained through an ePad: PSU can only generate this biometric signature
We considered that in the context of “inherence” elements, the fingerprint (as implemented in TouchID technology) could be used - technology weaknesses should be noted though. In addition, step up authentication (through profiling of customer behavioural analysis) could be used as an added inherence element.
Mobile devices are an excellent medium to provide the credentials, which cannot be ignored by the regulator and the community. However, the challenge of independence, is always there due to device loss or possible vulnerabilities on mobile phones, or the authentication app which can weakness the authentication process.
The challenges for dynamic linking authentication would be the non-ease of use from the user side. For example, it would be very difficult for the customer to re-enter data on the authentication device in order to generate linked authentication.
The generation of challenge response (where the PSP generate a challenge which is linked with all the transaction data and the PSU provides a response) would be a good solution for fulfilling the objective of dynamic linking.
We consider the clarifications suggested regarding the potential exemptions to strong customer authentication very useful.
We cannot think of any other factors EBA should consider when deciding on the applicable exemptions.
Another criterion which could be considered with respect with transaction risk analysis could be whether the transfer is within own PSU accounts.
We consider the clarification suggested regarding the protection of users personalised security credentials to be useful. However practical requirements are expected to ensure better security and more accurate compliance.
We identify an important risk with regards to the protection of users’ personalised security credentials the Internal Fraud and misuse of credentials by PSP’s employees.
The segment of the payment chain in which risks of PSCs are most likely to occur is the distribution of PSCs and the payment initiation.
We consider that PIS and AIS should establish a contractual agreement with PSP which among other things could be to ensure proper liability on behalf of AIS/PIS. In addition the bank should be in the position to refuse any kind of such agreement with any AIS/PIS.
We agree that e-IDAS regulation could be considered a possible solution to facilitate strong customer authentication and standardisation for communication. Once a digital signature is established and provided, the customer can receive their credentials encrypted and digitally signed on their email. This will surely facilitate the enrolment phase of credentials. It will also enable us to identify customers (unknown if this is appropriate for AML KYC processes). During the execution of the transaction, the data could be digitally signed to ensure less fraud.
We think that the use of “qualified trusted services” does address the risks associated with confidentiality, integrity. It also appears to provide the legal framework necessary for the exchange of data. As discussed the different “services” offer varying degree of confidentiality and integrity. Service (a) is dimmed too rudimentary for data integrity as opposed to (b) and (c).