Okay did its first compliance audit back in 2016. At the time, the audit framework was provided by the European Central Bank (ECB), in the form of the 2014 “Assessment Guide for the Security of Internet Payments”. Here, one idea sticks out: when a multi-purpose device is used for the ownership element, the payment and SCA should be done in a separate or independent channels. This was smart considering how internet banking was done ten years ago.
Eventually, the ECB recognised that banks would start using apps as a possession factor because two factors were already needed to use the app. Payments then could be initiated with just a password. However, given that viruses and malware were quite common, this caused a lot of security problems. In this context, requiring a separate channel for SCA also makes a lot of sense.
During our 2016 audit, the requirement for an independent channel made us have some lengthy discussions. How could we best ensure that our own SCA channel would be both separate and independent from the rest of the mobile device’s operating system? The solution we ended up implementing was to use a separate voice call that could run in tandem with our SDK. This would allow a one time PIN from the voice call to be entered into a secured screen displayed by the SDK.
Looking ahead, we might see future regulation on how to delegate payment authorisation to IoT devices, and how merchants instead of banks can perform SCA. These topics we are already discussing and working on today.
Be sure to read this article in full at okaythis.com/blog.
Who is Okay?
Okay is the fully PSD2 compliant Strong Customer Authentication platform that provides transaction and authentication security to apps, shielding the entire authentication process from any threats. We help all issuers, remittance services, and e-wallet providers comply with PSD2’s SCA requirements to deliver multiple authentication methods, including biometrics and strong security mechanisms at the point of transaction. Want to get to know us better? Visit okaythis.com.
The Payments Association
St Clement’s House
27 Clements Lane
London EC4N 7AE
© Copyright 2024 The Payments Association. All Rights Reserved. The Payments Association is the trading name of Emerging Payments Ventures Limited.
Emerging Ventures Limited t/a The Payments Association; Registered in England and Wales, Company Number 06672728; VAT no. 938829859; Registered office address St. Clement’s House, 27 Clements Lane, London, England, EC4N 7AE.
Log in to access complimentary passes or discounts and access exclusive content as part of your membership. An auto-login link will be sent directly to your email.
We use an auto-login link to ensure optimum security for your members hub. Simply enter your professional work e-mail address into the input area and you’ll receive a link to directly access your account.
Instead of using passwords, we e-mail you a link to log in to the site. This allows us to automatically verify you and apply member benefits based on your e-mail domain name.
Please click the button below which relates to the issue you’re having.
Sometimes our e-mails end up in spam. Make sure to check your spam folder for e-mails from The Payments Association
Most modern e-mail clients now separate e-mails into different tabs. For example, Outlook has an “Other” tab, and Gmail has tabs for different types of e-mails, such as promotional.
For security reasons the link will expire after 60 minutes. Try submitting the login form again and wait a few seconds for the e-mail to arrive.
The link will only work one time – once it’s been clicked, the link won’t log you in again. Instead, you’ll need to go back to the login screen and generate a new link.
Make sure you’re clicking the link on the most recent e-mail that’s been sent to you. We recommend deleting the e-mail once you’ve clicked the link.
Some security systems will automatically click on links in e-mails to check for phishing, malware, viruses and other malicious threats. If these have been clicked, it won’t work when you try to click on the link.
For security reasons, e-mail address changes can only be complete by your Member Engagement Manager. Please contact the team directly for further help.
