In accordance with recital 95 of PSD2, “payment transactions ... executed with modalities other than the use of electronic platforms or devices, such as paper-based payment transactions, mail orders or telephone orders, do not seem to necessitate the same level of protection regarding safe authentication as electronic payments ... Payment services offered via internet or via other at-distance channels, the functioning of which does not depend on where the device used to initiate the payment transaction or the payment instrument used are physically located, should therefore include the authentication of transactions through dynamic codes, in order to make the user aware, at all times, of the amount and the payee of the transaction that the user is authorizing”.

In the Final report on the draft RTS on SCA and CSC the EBA was already asked if "payments via e-mail" are considered within the scope of the SCA under PSD2 (EBA/RTS/2017/02, 23 February 2017, Question 90 page 94). 

However, the matter of transactions ordered by email was not explicitly addressed in the answer (“[…] anything initiated via paper or telephone is out of the scope”).

On the other hand, answering question 2021_6315 of the Single Rulebook Q&A EBA only clarified that the payer is not initiating the electronic payment itself in the situation where he orders a transaction by email, and therefore, does not qualify as “where the payer initiates an electronic transaction” as per Article 97(1)(b) of Directive (EU) 2366/2015 (PSD2).

The question is therefore whether transactions executed through a remote channel, at-distance channel or a payment instrument necessarily implies a process in which a payment order issued electronically by the payer is processed automatically in the payment system.

The affirmative answer to this question seems to imply that for the purposes of PSD2, namely for the purposes of:

• the obligations of the payment service user in relation to payment instruments [Article 69],
• the obligations of the payment service provider in relation to payment instruments [Article 70],
• evidence on authentication and execution of payment transactions [Article 72], and
• strong customer authentication [Article 97(1)(c)], 

the email, although it operates across computer networks, primarily the Internet, does not qualify as a remote channel, at distance channel or a payment instrument.

Because typically a transaction ordered by electronic mail (email) is not processed automatically in the payment system, but rather executed by an employee of the payment service provider.

For this reason, it seems that transactions ordered by electronic mail (email) do not qualify as transactions processed by a remote channel, at distance channel or a payment instrument and, therefore do not fall within the provisions and obligations of Article 69, Article 70, Article 72 and Article 97(1)(c) PSD2.