A look at the Payment Services Directive 2 regulations and the Strong Customer Authentication requirements

1. ®
PSD2, SCA, WTF?
Kelley Robinson | Twilio
@kelleyrobinson

2. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
💰$5.1B💰
In 2017

3. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
PSD2
Payment Services Directive 2

4. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
The original PSD (2007)
• Objective: create a single market for
modern payment services in the EU
• Paved the way for new payment
disruptors

5. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
What is PSD2? (2015)
• Updated regulations governing payment service
providers in the European Union
• Applies to card not present (online) transactions

6. What's new in 2019?
Strong customer authentication (SCA)
for purchases over €30
© 2019 TWILIO INC. ALL RIGHTS RESERVED.

7. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
SCA applies where the payer:
Accesses
its payment
account
online
A Initiates an
electronic
payment
transaction
B Carries out any
[risky] action
through a
remote channel
C

8. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
INHERENCE
BIOMETRIC
POSSESSION
MOBILE PHONE
KNOWLEDGE
PASSWORD
AUTHENTICATION FACTORS
Two are required to achieve SCA

10. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Beginning 14 September 2019, non-
compliant payments that require SCA
will be declined.
Stripe Report on SCA

11. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Not just for the EU
• Other regions are introducing similar requirements
• ROI for reducing fraudulent payments may be
worthwhile regardless

12. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Dynamic Linking Explained

13. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Dynamic Linking
Explained
Use code 312568 to
approve your Flourish
and Blotts transaction
of €713.00 to Gilderoy
Lockhart

14. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
(a) the payer is made aware of the
amount of the payment transaction
and of the payee;
Ensure the user is confident they are
authenticating the right transaction.

15. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
(b) the authentication code
generated is specific to the amount
of the payment transaction
Any code must be used for
that specific transaction only.

16. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
(c) the authentication code accepted by the
payment service provider corresponds to
the original specific amount
Once a valid code is accepted, other
channel codes are invalidated.

17. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
(d) any change to the amount or the
payee results in the invalidation of
the authentication code generated.
If transaction details change, invalidate
all outstanding codes.

18. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Exemptions
• Low risk transactions (based on provider's fraud rates)
• Under €30
• Recurring payments (fixed or variable "merchant initiated")
• Over the phone payments

19. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
How to Implement SCA

20. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
3D Secure
• MFA implemented by credit card providers
• V2 uses device data to do risk analysis &
adaptive auth
• MFA challenge still required for non-exempt
SCA payments (no "frictionless" option)

21. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
SMS
• No app install required
• Easily include transaction info in
the message body
• Vulnerable to phishing & man in
the middle attacks
Use code 312568 to
approve your Flourish
and Blotts transaction
of €713.00 to Gilderoy
Lockhart

22. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Transactional TOTP
• Requires authenticator app
• Works offline
• Based on the Time-based One-time
Passwords RFC 6238 standard
• More secure than SMS

23. Demo
© 2019 TWILIO INC. ALL RIGHTS RESERVED.

24. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Push Authorization
• Requires authenticator app and/or dev work
• Cryptographically most secure
• Seamless user experience
• Easily customize with your brand

25. Security = Friction
© 2019 TWILIO INC. ALL RIGHTS RESERVED.

26. Friction = Abandoned carts
© 2019 TWILIO INC. ALL RIGHTS RESERVED.

27. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Time is money
• Slow transactions may lead to
fewer sales
• Offer options (+retries) to keep
customers happy

28. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Considerations
• Are you a payment service provider?
• Does your PSP already provide a solution?
• Do you deal directly with consumers?
(hospitality/travel booking)
• Do you process payments immediately?

29. © 2019 TWILIO INC. ALL RIGHTS RESERVED.
Resources
About PSD2 + SCA
Regulatory Technical Standards (aka The Law)
Understanding Dynamic Linking
Twilio PSD2 E-Book
Stripe's Guide to SCA
Wikipedia Reference
Implementing SCA
3D secure
Twilio Documentation
Transactional TOTP Guide
Push, SMS Guide with Twilio + Python

30. ®
THANK YOU
@kelleyrobinson

31. © 2019 TWILIO INC. ALL RIGHTS RESERVED.