Introducing Strong Customer Authentication: What you need to know

I was not sent the message, it was a friend. I have asked what bank sent them that.

Looks like it came from John Lewis - I got an email because i’m just a member of “myJohn Lewis” with basically exactly the same message (I don’t bank with them) - will be interesting to see what happens :man_shrugging:t2:

1 Like

Surely Apple Pay and Google Pay have always been PSD2 compliant? Should be no change there.

3 Likes

Yeah I am curious if monzo will be as bad as that given it’s a mobile only bank. I would hope you could leave the card at home and approve on the app when it happens and just retry in the store at least. Tbh I would hope it wouldnt affect us that much at all.

Risky Game leaving the card at home.

There have been a number of times where I’ve tried going cardless, then having to go get it because the terminal doesnt accept apple pay, over the limit etc (tesco :eyes:)

Now I always carry my card

You are already authenticating when using Fingerprint, face id. or device PIN. Same as chip and PIN using your card, there is no change there. If you are paying by card using your PIN what additional authentication could be required? Enter PIN again?

Its if you leave your card at home and are using Apple Pay/Android Pay that I am curious about. With another bank saying “well it may randomly be blocked so always take a card” I was wondering if this is also the same case with Monzo given its a mobile based bank.
I have never had apple pay fail for me yet as long as I am under the limit.

@Rika has spoken!

5 Likes

Only my opinion but I think that’s nonsense. Mobile wallets are compliant, always have been. You can expect to be declined if the terminal does not support high value and the transaction is over £30 but that’s the case today. “We may randomly decline your payments by Apple Pay” Why? Just for fun?

“if you plan to use contactless payment make sure you have the relevant card with you” I’d like to see anyone making a contactless payment without the card". I think they got a work experience student to write that.

Perhaps they mean if you’re making a contactless mobile wallet payment? You should carry the physical card also?

Still I hope that doesn’t become a thing where stores start checking because they’ll be tedious. I often leave my wallet at home and don’t bother taking it out.

Oh, no doubt that’s what they mean, just not what they say. Be a lost sale if they do it to me.

It reminds me of the odd time you get those store staff who insist on checking whether your card has a signature on the back and then cause a problem about it.

I don’t think I have signed any of my cards…

1 Like

I am very confused by this John Lewis email and I say this as someone who shops there semi-regularly.

It is not up to the merchant, only that their terminals should support the Consumer Device Cardholder Verification Method (CDCVM), which was mandated by Mastercard rules from the 1st of January this year (with a few notable exceptions from other large UK merchants but John Lewis does support this well) to fully support Apple Pay, Google Pay, and other mobile wallets.

On the web side, they should support 3D Secure v2.

If you’re using contactless on a physical card (which has no verification), you will be required to insert your card and enter your PIN periodically. Apple Pay, Google Pay, and other mobile wallets should not require this if everybody has played their part in the chain correctly.

15 Likes

I’ve been in a furniture store and been told they didn’t accept Apple Pay when paying my deposit. However, someone forgot to tell the terminal which happily accepted. Next, a total fiasco ensued when the manager called head office trying to get the payment reversed. I kid you not. I also had to reassure the staff member that served me that I would explain to his manager it was not his fault as I had decided to try anyway and he did not have a chance to stop me.

3 Likes

Interesting, why would there be exceptions and are you able to name any. As far as Mastercard rules go, (and Visa) we know that some merchants choose to ignore certain rules with apparent impunity, minimum payments being one rule frequently and blatantly violated, so why not others.

I can’t talk about the business reasons behind this specifically but I can say this:

Small merchants aren’t worth going after for minor rule violations.

Large merchants have the money and lawyers to negotiate extensions or entire exemptions to just about anything (see: EMV chip rollout in the US).

7 Likes

Ah, so we might expect Amazon to carry on as currently. I did wonder if they could as they have always binned 3d secure, thankfully.

Ah, the difference here is that Strong Customer Authentication is law.

Until now, Amazon has taken on fraud risk to maintain their one click checkout. Your guess is as good as ours for what they will do for SCA.

5 Likes

Of course. It will be interesting then. We’ll find out soon.