From tomorrow, European banks must confirm many online card payments with a second step, usually in their app. A Canadian store selling to Europe should check its checkout supports 3-D Secure 2, and test it on a phone.

What starts tomorrow

From tomorrow, September 14, European rules require banks to make sure that the person paying online is really the cardholder, for many card payments.

The requirement is called Strong Customer Authentication, usually shortened to SCA, and it comes from a European payments directive known as PSD2.

In practice, a customer in Germany or Spain paying by card may be asked to confirm in their banking app, or with a code sent to their phone, before the order goes through.

European regulators are allowing the payments industry extra time to move online card payments over, so the change will arrive unevenly over the coming months rather than all at once on Saturday.

What counts as strong

The rule asks for two of three kinds of proof: something the customer knows, such as a password or PIN; something they have, usually their phone; and something they are, such as a fingerprint.

A card number, expiry date and the code on the back do not count. Anybody holding the card, or a copy of its details, has all three.

For online card payments, the check runs through 3-D Secure, the system behind the password pages some shoppers remember as Verified by Visa or Mastercard SecureCode.

Where a Canadian store fits

The rules are European, and how far they reach depends on where each side of the payment sits.

The third is where a Canadian store feels it. Nothing obliges a Canadian checkout to support the check, but a European bank can decline a payment that arrives without it, and to the customer that looks like your store failing.

3-D Secure 2

The first version of 3-D Secure was clumsy: a password page in a pop-up, passwords nobody remembered, screens that broke on phones. Many stores switched it off because customers gave up at that step.

Version 2 sends the bank much more with each payment, such as details of the device, the shipping address and whether the customer has bought from you before.

With that, the bank can approve many low-risk payments without asking the customer anything. When it does ask, the request appears inside the checkout or in the bank's own app, and it is designed to work on a phone.

What changes at the checkout

For a customer with a European card, there may now be one more step between pressing pay and seeing the order confirmation.

The checkout has to wait for it. A customer on a phone who switches to a banking app and comes back should find the order still waiting, not an expired session or an empty cart.

A failed or abandoned check needs a clear message and a way to try again, rather than a generic payment error that sends the customer elsewhere.

Some payments are exempt or treated more lightly: very small amounts, later payments in a subscription after the first, and payments the bank judges low risk. Which exemptions are requested is usually the payment provider's job, not the store's.

A worked example

A two-person workshop in the Kootenays sells handmade leather watch straps online, and has a small, loyal group of customers in Germany, Sweden and the Netherlands.

Its checkout used an older payment plugin, untouched for three years, that sent card details to the processor from the store's own server. It had no way to show a bank's request to the customer.

Reading about the deadline this week, the owner found two emails from the processor about it, filed unread over the summer with its other notices.

Whoever looks after the site updated the store software and replaced the plugin with the processor's current one, which uses card fields served by the processor and supports 3-D Secure 2.

They tested it with the processor's test cards that trigger a bank request, on a laptop and on a phone, switching to another app and back.

A line at checkout now tells European customers that their bank may ask them to confirm the payment, and that the request always comes from the bank, never from the store by email.

What to ask your payment provider

Most of this is settled by the payment provider, so ask it these questions and keep the answers.

Does it support 3-D Secure 2, and is it switched on for your account or does it need turning on?

Does the way your store connects to it support the bank's request? Older plugins and direct connections often do not; current hosted payment pages and embedded card fields usually do.

How are saved cards and subscriptions handled? The first payment usually needs the check, so that later ones can go through without the customer present.

And where will declined payments show, so you can tell a failed check from a card that was simply refused?

Who carries the fraud

A payment that passes 3-D Secure generally moves the cost of a fraud claim from the store to the customer's bank.

For a store that has absorbed chargebacks on stolen cards, that is a reason to welcome the check rather than resent it.

Some stores ask for it on every payment for that reason; others only where the bank or the risk calls for it. That balance is worth settling with the provider.

The counter-case

A store with no European customers, or a handful a year, has little to change. Cards issued in Canada and elsewhere outside Europe are unaffected, so check the order history first.

A store whose checkout is run by a hosted platform may find the work already done. The job there is confirming it, not rebuilding anything.

For any store with regular European customers, though, confirm the checkout supports 3-D Secure 2 and test it on a phone.

The checks, in order

  1. Count your European orders from the past year.
  2. Find your processor's notices about authentication.
  3. Ask whether 3-D Secure 2 is on for your account.
  4. Update the payment plugin and store software.
  5. Test a payment that triggers a check on a phone.
  6. Add a line about bank confirmation at checkout.
  7. Watch declined payments for the next month.

Step five is the one that tells you whether the rest worked. A check that appears on a laptop can still fail on a phone, where the customer has to leave for a banking app and come back.

Moving card entry off your own pages, which also simplifies this change, is covered in card skimming code on a checkout page.

Frequently asked questions

What is Strong Customer Authentication?

A European rule, starting September 14, requiring banks to confirm many online card payments with two of three proofs: something the customer knows, has, or is.

Does it apply to a Canadian store?

Not directly, since your processor's bank is usually in Canada. But a European bank can decline a payment that arrives without the check, which looks like your store failing.

What is 3-D Secure 2?

The newer version of the bank check behind online card payments. It sends the bank more information, so many payments pass without a challenge, and it works properly on phones.

What changes for customers at checkout?

Customers with European cards may be asked to confirm the payment in their banking app or with a code. The checkout must wait for that step and survive the switch.

What should I ask my payment provider?

Whether 3-D Secure 2 is on for your account, whether your plugin or connection supports it, how saved cards and subscriptions work, and where declined payments will show.

Is there any benefit to the store?

Yes. A payment that passes 3-D Secure generally moves the cost of a fraud claim from the store to the customer's bank, which helps stores troubled by chargebacks.

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.

Customers in Europe paying by card?

Send us your store's address and payment provider. We will check whether your checkout handles the bank's step.

Start a Conversation