# Delivering Strong Customer Authentication in the Banking Sector Author: Pal Sinha, Barnali Author URL: https://financedigest.com/author/pal-sinha-barnali Published: 2017-08-09 Category: BANKING Category URL: https://financedigest.com/category/banking Meta Title: PSD2 and SCA: The Future of Banking Security Regulations Meta Description: Explore how new regulations like PSD2 and GDPR are transforming the financial services industry, with a focus on security and innovation. URL: https://financedigest.com/delivering-strong-customer-authentication-in-the-banking-sectorhtml ![undefined](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/0o1a8644-2588-1736843609335-compressed.jpg) By **Howard Berg,** Senior Vice President and Managing Director, Gemalto UK ![Howard Berg](https://prod.superblogcdn.com/site_cuid_cm5qst7v3003gwirgwqtxn8i8/images/howard-berg-1736843609169-compressed.jpg) Howard Berg When innovations start to create real value, the authorities start to regulate. So if you want to see where value is being created, have a look at where new regulations are coming into force. The [digital revolution](https://www.financedigest.com/the-fintech-digital-revolution-will-continue-in-2022.html "The Fintech Digital Revolution Will Continue in 2022") is one example. It is changing [nearly all business sectors](https://www.financedigest.com/demand-for-tissue-and-hygiene-market-from-key-end-use-sectors-to-surge-in-the-near-future.html "Demand for Tissue And Hygiene Market from Key End-use Sectors to Surge in the Near Future"), and financial services is no exception. In fact, things have [changed so much that both national and European authorities are legislating to regulate the digitalization](https://www.financedigest.com/the-antibodies-contract-manufacturing-market-to-see-through-the-probable-sea-change-through-digitization.html "The Antibodies Contract Manufacturing Market to see through the probable sea change through digitization") of financial services. The EU has come up with the General [Data Protection Regulation (GDPR), which affects multiple sectors and requires organisations to make sure appropriate measures are taken to establish immediately whether a personal data breach](https://www.financedigest.com/amazons-twitch-blames-configuration-error-for-data-breach.html "Amazon’s Twitch blames configuration error for data breach") has taken place. Meanwhile, the financial services [industry is getting ready for the second Payment](https://www.financedigest.com/end-of-year-overview-of-the-payments-industry.html "End of year overview of the payments industry") Services Directive (PSD2), which was already voted in by the EU Parliament in 2015. Governments of the member states are currently in the ratification process, and by the beginning of 2018, PSD2 will have be enshrined in law in most EU states. One of the main elements of the directive is the mandatory adoption of Strong Customer Authentication (SCA) as the next [step to improve security in the industry](https://www.financedigest.com/struggling-british-pig-industry-calls-for-tesco-to-step-up.html "Struggling British pig industry calls for Tesco to step-up"). This requirement is defined in PSD2 – and the common Regulatory Technical Standards (RTS), issued by the [European Banking](https://www.financedigest.com/u-s-european-banks-could-lose-over-5-billion-from-risky-buyout-loans.html "U.S., European banks could lose over billion from risky buyout loans") Authority (EBA), give details on how to implement it. Not everyone in the EU welcomes the RTS, since banks sometimes struggle with the additional compliance tasks. But new [digital technology](https://www.financedigest.com/discrete-digitization-to-drive-the-assisted-reproductive-technology-market.html "Discrete digitization to drive the Assisted Reproductive Technology Market") opens the way to new breeds of cyberattack, which in turn call for greater security. The upcoming PSD2 makes SCA mandatory to protect [banks and their customers](https://www.financedigest.com/the-bank-of-me-why-banks-need-to-be-totally-customer-centric.html "The bank of me – why banks need to be totally customer centric") against such attacks. How can banks comply? Among other things, they need to use at least two of the following three elements for authenticating users: - Something you have (possession); - Something you know (password or PIN code) - Something you are (fingerprint, face, voice). Today the most common combination is the first two factors, but with the increasing use of mobile devices for banking, biometric factors will likely become more important. The iPhone has played a huge role in establishing fingerprints as a convenient method of authentication, while many other [smartphones support face or even eye](https://www.financedigest.com/smartphone-maker-xiaomi-switches-china-playbook-with-eye-toward-ev-showrooms.html "Smartphone maker Xiaomi switches China playbook with eye toward EV showrooms") scans. **How regulation benefits banks** Regulations such as PSD2 are necessary to secure further [progress in the digital world](https://www.financedigest.com/cricket-injured-buttler-progressing-well-ahead-of-t20-world-cup.html "Cricket-Injured Buttler ‘progressing well’ ahead of T20 World Cup"). [Consumers will not use services if they are concerned](https://www.financedigest.com/tesco-reported-to-competition-watchdog-by-consumer-group-over-pricing-concerns.html "Tesco reported to competition watchdog by consumer group over pricing concerns") about security. Thanks to similar developments in the past, the [banking sector](https://www.financedigest.com/improving-reputation-in-the-banking-sector-through-marketing-communications.html "IMPROVING REPUTATION IN THE BANKING SECTOR THROUGH MARKETING COMMUNICATIONS") has managed to become a role model for data protection. Since the first PSD came out in 2007, the level of security in financial institutions has improved – as shown by the annual [Breach Level Index](http://breachlevelindex.com/), which analyses the number of records breached in several sectors. In the financial services industry, this number has been declining for years. In 2016, only 1% of all data losses occurred in this sector [\[1\]](#_ftn1). So although cyber criminals are obviously attracted by the valuable information held by banks, the industry managed to implement security measures that have significantly reduced the number of incidents. Regulations like these are positive, but often not sufficient in isolation. In fact, the [market itself has in the past created its own regulations to boost](https://www.financedigest.com/structured-cabling-market-growth-of-it-telecommunication-industry-to-boost-market.html "Structured Cabling Market – Growth of IT & telecommunication industry to boost market") security and build business – PCI is one example. Currently, the technical implementation of SCA is just part of a much larger [security challenge](https://www.financedigest.com/hybrid-working-and-the-continued-security-challenges-for-financial-organisations.html "Hybrid working and the continued security challenges for financial organisations"). To be successful, [banks and other financial services](https://www.financedigest.com/the-role-of-fintech-in-disrupting-traditional-banking-services.html "The Role of Fintech in Disrupting Traditional Banking Services") providers need to make sure that users benefit from better protection mechanisms. If they don’t, the consequences could be severe. A recent survey of end-users all over the world looked at how important data protection and usability are when consumers select a payment service [\[2\]](#_ftn2), and the results show how important security is for consumers. In general, there is still a positive attitude towards new technologies: [consumers will adopt](https://www.financedigest.com/growth-in-sales-of-fed-microbial-market-to-be-largely-driven-by-rising-consumer-adoption.html "Growth in Sales of Fed Microbial Market to be Largely Driven by Rising Consumer Adoption") them if the technologies provide more convenient ways to pay. But consumers also have doubts about security.  Currently, 58% of users [expect their data to be stolen in the future](https://www.financedigest.com/the-cardiovascular-information-systems-market-is-expected-to-grow-on-a-persistent-note-in-the-future.html "The Cardiovascular Information Systems Market is expected to grow on a persistent note in the future"). If the stolen data was held by a retailer, 60% would stop shopping there – usually to punish unsafe organizations. The number grows to 66% for businesses in which financial or sensitive information was stolen. While regulations have already done a lot to protect consumers, new technologies open up new possibilities for attack, cybercriminals are becoming more organized, and the financial services industry needs to [stay one step ahead](https://www.financedigest.com/staying-ahead-in-the-digital-era-a-cfos-roadmap-to-future-proof-solutions.html "Staying Ahead in the Digital Era: a CFO’s Roadmap to Future-Proof Solutions"). **Getting ready for the new era of banking** The challenge for implementing SCA is huge, involving many actors and procedures. Technologies and processes need to be compliant, while at the same time matching user expectations. On top of the compliance challenge, psychological factors come into play. In fact, political institutions are not the only ones pushing for greater security: consumers also see providers as having an obligation in this area. According to the survey mentioned earlier, users place 70% of the responsibility for security within companies, and only 30% in their own hands. But consumers don’t just want security: they also want convenience. If it they suffer too many disruptions in the name of security, they will simply abandon their virtual [shopping cart](https://www.financedigest.com/e-commerce-stop-reinventing-the-shopping-cart.html "E-commerce: Stop reinventing the shopping cart"), and satisfaction with their bank’s services will drop. To master the challenges of new technology, compliance, and [user demands](https://www.financedigest.com/ammonium-phosphatides-market-2022-research-on-user-demand-size-applications-key-players.html "Ammonium Phosphatides Market 2022 Research on User Demand, Size, Applications, Key Players") for both security and convenience, organizations need to look for partners that provide know-how in authentication and verification. These [systems are complex and require specialized know-how to reach](https://www.financedigest.com/telecom-tower-power-system-market-is-expected-to-reach-us6-7-bn-by-2031.html "Telecom Tower Power System Market is expected to reach US.7 Bn by 2031.") compliance and provide better services by balancing security and convenience. **Claiming a stake in value creation** The EU has made it clear within PSD2 that new players should be able to compete in the field of financial services. While banks might feel threatened by this, they can use the ever-increasing awareness of the need for better security in their favour. To do so, they must provide [security solutions](https://www.financedigest.com/securing-financial-institutions-with-the-help-of-pam-solutions.html "Securing financial institutions with the help of PAM solutions") that meet the expectations of both users and policy-makers. [Payment Service Providers need to look out for authentication](https://www.financedigest.com/the-key-trends-in-payment-authentication.html "The key trends in payment authentication") methods that protect users, while enabling new use cases. With their existing customer base, they have an advantage to position themselves as leading the digital revolution. But they must be careful when managing all the different tasks that enable timely adoption – which include security and certification. Just one misstep could prove disastrous. Because of this, SCA is more than just a technological or a legal issue. It is a key ingredient to delivering the security that will open up new possibilities in the [banking sector](https://www.financedigest.com/how-effective-talent-management-could-disrupt-the-retail-banking-sector.html "HOW EFFECTIVE TALENT MANAGEMENT COULD DISRUPT THE RETAIL BANKING SECTOR"), enabling banks to claim their stake in the innovative new ways of creating value. [\[1\]](#_ftnref1) Gemalto 2017: Breach Level Index 2017 [http://www.breachlevelindex.com/](http://www.breachlevelindex.com/) [\[2\]](#_ftnref2) Gemalto 2017:  „Consumer vs Business“ [http://www6.gemalto.com/2016-data-breaches-customer-loyalty-report-pr](http://www6.gemalto.com/2016-data-breaches-customer-loyalty-report-pr) --- This blog is powered by Superblog. Visit https://superblog.ai to know more. ---