The Strong Customer Authentication (SCA) requirement of the Revised Payment Services Directive (PSD2) significantly influences the technical choice between server-side and client-side One-Time Password (OTP) validation architectures for recurring payments by mandating a robust, secure, and auditable authentication process for the initial transaction. SCA requires authentication to be based on at least two independent elements from the categories of knowledge (something only the user knows, like a password), possession (something only the user possesses, like a phone or token generating an OTP), and inherence (something the user is, like a fingerprint). The primary goal of SCA is to enhance security and reduce fraud for electronic payments. For recurring payments, SCA applies to the very first transaction in the series, while subsequent transactions can often be exempt from SCA if a proper mandate was established during the initial SCA-compliant transaction. OTPs serve as a common method for fulfilling the 'possession' element of SCA. The technical influence stems from how each architecture can demonstrably meet SCA’s stringent security and independence requirements, especially considering lia....
Log in to view the answer
