Strong Customer Authentication

Communication for Consumers

What is Strong Customer Authentication (SCA) and why is it being introduced?

Strong Customer Authentication (SCA) is a new set of rules that will change how you confirm your identity when making purchases online as required by the Payment Services Directive (PSD2).

SCA is being introduced to help further reduce fraud. With increasing amounts of purchases being made online, these new rules will provide the extra protections necessary to ensure that customers are safe when purchasing online and their money is better protected.

When a shopper in the European Economic Area (the EEA) uses a card issued from an EEA bank to make a payment, additional levels of authentication will be required. It will be no longer possible to pay for something online by using only card details, such as card number and CVC code.

The "two factor authentication" requirement of SCA means that an online shopper will have to provide two out of the three acceptable means of proving their identity:

• Knowledge: Something they know (Password, PIN, Secret fact etc)
• Possession: Something they own (Mobile phone, token, smart card)
• Inherence: Something they are (Iris recognition, fingerprint, voice recognition, face recognition)

Next time you shop or access your account online, you may need to undertake an extra step to confirm it’s really you. We will use a number of ways to verify a purchase or login such as a passcode via text message, receiving a phone call to your landline or using an app on your smartphone.

Key Messages

• In order to shop online or access your account online, you may be asked to take extra steps to confirm it’s really you.
• This is due to the new rules that are being introduced, changing how you prove your identity online. These rules will further help to reduce fraud and protect customers.
• You need to be ready to provide an extra step to verify yourself, if required. We use a number of verification methods such as a passcode via text message, receiving a phone call to your landline or an app on your smartphone.
• Some types of transactions are exempt from SCA, meaning that you may not always be asked to complete extra security steps.
• You need to make sure we have up to date contact details for you (such as a telephone number and email address).
• You can contact us for more information on these changes, including how you may need to confirm your identity.
• Remember: We will never contact you out of the blue to ask for your PIN, full password or to move money to another account. Only give out personal or financial details to use a service that you are expecting to contact you, that you have given your consent to and that you trust.

What will SCA mean for me?

These rules will apply to you when you are making an online purchase or access your account online. For example, when buying items from online retailers, you may receive a text message from us containing a passcode. You will then be prompted to enter this code on screen before your payment will be taken.

We will also offer alternative ways of confirming who you are. These can include a call to your landline phone or using your account app on your smartphone, if you have one.

When access your account online, you will be asked to verify who you are in a similar way as for online shopping. If you access your account via an app you may have already provided the authentication needed by using your fingerprint, a code, or facial recognition to log in.

You may not be asked to prove your identity in this way for every purchase or transaction.

What do I need to do?

Be ready for the changes by making sure your contact details are correct and up to date. If you access your account online, you can update your phone number and other details there. If not, contact your dedicated customer services team through the usual channels.

As always, remember to Take Five and stop to think. We will never contact you out of the blue to ask for your PIN, full password or to move money to another account. Only give out your personal or financial details to use a service that you have given your consent to, that you trust and that you are expecting to be contacted by.

FAQs

I don’t have a mobile phone. How can I verify my identity?

We offer alternative arrangements to help you verify your identity. Please contact your dedicated customer services team through the usual channels if you need to update your details or to discuss other options.

Do these rules only apply to online purchases?

Whilst the biggest changes you are likely to see are online, SCA will also apply in a face to face environment. As Chip & PIN is a familiar way of proving your identity, for most purchases you won’t have to do anything different. However, if you make contactless payments, SCA may mean you have to input your PIN slightly more often.

I buy online from the same websites regularly. Will I have to prove my ID every time?

In future, you may have the opportunity to add some sellers to a ‘trusted beneficiary’ list, meaning that you will not need to go through SCA when purchasing from that store or organisation. However, if we suspect unauthorised activity (such as an unusually large order or delivery to a different address) we may still ask you to confirm your identity.

Will this make it harder for me to shop online?

SCA is being introduced to help further reduce fraud. With an increasing number of purchases being made online, extra protections are necessary to ensure that customers are safer, and their money better protected.

Is every payment I make going to be affected?

Not all payments will be affected. Non-electronic payments, such as cash and cheques, are not in scope of these changes. All purchases made by telephone (for example, buying from a catalogue by calling the company and giving your details over the phone) are not in scope. Automatic payments that you make regularly to the same provider (e.g. a subscription to online streaming platform) do not require SCA. You may still be asked for additional identity checks when initially setting up these payments.