EPA-强化客户认证对支付用户的影响（英文）-2019.8-24页_2mb

Summary of "Issuer Declines": The Impact of SCA on Payments Users

Core Content

This white paper examines the impact of Strong Customer Authentication (SCA), mandated by the European Union's PSD2 directive, on the payments experience for consumers and merchants in the UK. The compliance deadline for SCA was set for 14th September 2019, and the paper highlights the challenges and implications of implementing these security measures across the payments ecosystem.

Main Viewpoints

• SCA Compliance and Friction: SCA introduces additional friction in the payments process, which is expected to negatively impact the user experience (UX), particularly for online transactions.
• Impact on Transaction Rates: Issuers predict that the number of transactions being declined will rise from 3% to 25–30% in the short term, while step-up authentication requests could increase from 2% to 30–50%.
• Authentication Methods: The top methods being explored include One-Time Passwords (OTP) via SMS, 3DS technology, and in-app authentication. Biometrics is seen as a better UX solution but is not widely supported yet.
• Challenges for Issuers and Merchants: Both parties face significant challenges, including limited regulatory clarity, delayed feedback, and the need for a unified approach to SCA implementation. Merchants, especially SMEs, have low awareness of SCA requirements.
• Need for a Managed Roadmap: Issuers and acquirers stress the importance of a managed roadmap to ensure a smoother transition and reduce the negative impact of SCA on the market.
• 3DS v2.1 and v2.2: Merchants are advised to implement 3DS v2.1 as soon as possible and transition to 3DS v2.2 once it is fully tested and available. 3DS v2.1 is expected to satisfy SCA legal requirements, while v2.2 offers full support for merchant-initiated transactions (MIT) and other advanced features.
• Biometrics: Biometric authentication is seen as a long-term solution for a better UX, but it is not expected to be widely adopted before 2021 due to cost, immaturity, and supply chain limitations.

Key Information

SCA Overview

• SCA is a requirement under the PSD2 directive, mandating multi-factor authentication for online payments.
• It requires authentication from two of the three categories: possession, knowledge, and inheritance, and must be dynamically linked to a transaction.
• The FCA is the UK's competent national authority (CA) overseeing SCA compliance.

Impact on Payments Experience

• Consumer Impact: Increased friction in the payments process may lead to higher basket abandonment rates and lost customers.
• Merchant Impact: Merchants are concerned about the negative impact on UX and revenue. SMEs, in particular, lack awareness and preparation for SCA.
• ECommerce Focus: SCA will have the most significant impact on ECommerce transactions, which are expected to see a major rise in step-up authentication and transaction declines.

Authentication Strategies

• Top Approaches: OTP via SMS, 3DS technology, and in-app authentication are currently being used.
• Negative UX Impact: OTP and 3DS are expected to have a significant negative impact on UX.
• Biometrics: Biometrics is seen as a better UX solution, but adoption is expected to be slow.
• 3DS v2.1: 66% of issuers expect to be ready with 3DS v2.1 by the end of 2019, and it is considered to satisfy SCA legal requirements.

Readiness Status

• Current Readiness: Only 17% of UK issuers are currently ready for SCA, with 75% expecting readiness by 14th September 2019.
• Delayed Readiness: Some issuers are not expected to be fully compliant until the first half of 2020.
• Need for More Time: Many stakeholders feel the timeline for SCA implementation is too short, and more time is needed for the entire ecosystem to be ready.

Exemptions and Chargebacks

• Exemptions: Issuers and acquirers are looking to use exemptions such as Transaction Risk Analysis (TRA), low-value transactions, contactless payments, and trusted beneficiaries to reduce the impact of SCA.
• Chargeback Management: The paper emphasizes the importance of effective chargeback management, as the number of chargeback disputes has remained the same as one year ago.
• Friendly Fraud: Acquirers are advised to invest in identifying and managing friendly fraud to qualify for SCA exemptions.

Recommendations

• Merchants: Should implement 3DS v2.1 now and migrate to v2.2 when available. They should also ensure that their systems are prepared to handle step-up authentication and transaction declines.
• Payment Providers: Must be involved in SCA implementation and communication to ensure a consistent and optimal UX for all stakeholders.
• Industry Collaboration: There is a need for collaboration across the payments ecosystem to ensure a smooth and secure transition to SCA.

Conclusion

The implementation of SCA is a significant shift in the payments industry, aimed at improving security but with a potential cost to UX and revenue. While the technology is evolving, the current readiness of the ecosystem is limited, and stakeholders are calling for more time and clarity. The long-term solution involves the adoption of biometrics and 3DS v2.2, but for now, the focus remains on 3DS v2.1 and OTP as the most accessible methods. A managed roadmap and increased awareness are essential to ensure that SCA is implemented effectively and without unnecessary disruption to the consumer and merchant experience.