Reset “Strong Customer Authentication” (SCA) limit in app?

[jph]

As per title.

Prevent unwanted surprises at merchants who don’t yet support contactless + PIN.

[Rat_au_van (Em)]

This?

We've released in-app payment verification for times when you can't use your PIN!

In lots of cases it seems to be merchants operating their terminals wrong (chip & signature, chip without PIN, or even magstripe even though their terminal is chip and PIN capable). So in many cases they should retry with chip & PIN (especially if you ask them to) Most vending machines support contactless, so if you’re not at your contactless limit you should be able to use that instead (or Apple or Google Pay). Unfortunately yes, this retry flow won’t work if you don’t have any data For what…

[jph]

No, I don’t think so. That post seems massively wordy and I don’t really follow but what I’m looking for is a manual reset.

[tbutz (🏳️‍🌈 Producer of "low value commentary")]

I think this is the post that’s relevant here:

Strong Customer Authentication: Using Chip and PIN more often when making contactless payments

It’s not clear this is a compliant approach. There is an EBA Q&A that very strongly suggests that you can’t do this. They make it clear that the SCA needs to be tied to a payment initiation, and generally prove the customer is still in possession of the card. Of course we’ll keep an eye on these sort of implementations to make sure we aren’t over interpreting the law. But right now our focus is on producing the most user friendly and complaint implementation. I would assume that other banks …

The point being that you have to tie the “reset” of the contactless limit to a payment and with card in possession.

[jph]

Interesting. Can it be a cardholder not present payment?

[phildawson (Sorry, I will have to escalate this.)]

@Rat_au_van was commenting on your ‘Prevent unwanted surprises at merchants who don’t yet support contactless + PIN.’

That post is about making a button in the app that you can press if the merchant/device doesn’t support it, so you can try again within 15mins.

[phildawson (Sorry, I will have to escalate this.)]

Revolut have just implement what you are asking for but it isn’t really following the SCA rules by not proving you are in possession of the card when you tap the app.

Franky the whole thing is ridiculous. On par with cookie notices on websites.

https://blog.revolut.com/contactless-payments-are-becoming-more-secure/

At this point, you can either make your next payment via Chip & PIN, or tap on the notification and reset your limit from the Revolut app (you will need to enter your PIN, or using fingerprint/face ID)

…

@phildawson

Yeah it doesn’t follow the rules but I like the fuck you attitude to SCA.

Seems like a sensible way to reset the limit, almost makes it pointless having the limit in the first place…

I think Monzo is too to have the balls to do this. Especially with going above and beyond when it’s not always best to do that (cough £100 v £135 limit)

[SouthseaOne (Michael)]

@phildawson

Revolut have just implement what you are asking for but it isn’t really following the SCA rules

So far so Revolut!

I did recently get an account with them, but trust them about as far as I can throw them

[barrysingh101 (Barry)]

True the rules do allow contactless+pin but this isn’t currently widely adopted and is this requires the pin terminals to be updated which is out of Curve’s control. At the moment most terminals will try to authorise a contactless transaction, fail and ask for you to insert your card, by which time you will have probably already put it back in your wallet. If the normal app use to check transactions can reset the SCA limits then most people would never have to be bothered by it.

[Kumnaa]

@phildawson

Revolut have just implement what you are asking for but it isn’t really following the SCA rules by not proving you are in possession of the card when you tap the app.

I wonder if Monzo could get around this by using NFC when resetting in the app to prove you have the card in a similar fashion to activation.

Doesn’t help with the “bring tired to payment initiation” aspect though but then I don’t pretend to know much about this

[phildawson (Sorry, I will have to escalate this.)]

I’ve since looked through the rules and can’t find anything to say you can’t explicitly reset in the app to confirm you have control of the card and it hasn’t been nicked/lost.

I posted recently here about it if you dare to follow that thread. I think the Monzo staff have got weirdly got annoyed at me for pointing out the legacy banks haven’t actually implemented SCA yet so I’m not holding out on them replying again.

Strong Customer Authentication: Using Chip and PIN more often when making contactless payments

I’ve looked through the EBA as much as I can bear, I can’t find any specific rule to say that resetting limit through an app is a solid no. Have Monzo put this forward to get a definitive answer? Or assuming it’s probably a no and Revolut are being naughty. If it’s a yes thats fine, and they classify the customer pushing the button as acknowledgment I’ve got the physical card in my possession thats a game changer. If they pushed the button without actually checking their wallet then its on the…

If you want a quick summary of my stance I made this post too

Strong Customer Authentication: Using Chip and PIN more often when making contactless payments

What we (well me) are talking about is a few things. Monzo jumped on £100 (and reserving £30 for offline transactions). Imho they have over interpreted the spec in taking offline into consideration and not gone with £135 like Starling and other fintechs. It takes an already low amount (imo) and reduces it unnecessarily further. No legacy bank has met the 14 September deadline to my knowledge and are now working to the 14 March 2020 deadline. Or failing that deadline the 14th March 2021 de…

[Neatmike]

I think where it landed was… if you are really against mobile payments, and the thought of -shock horror - contactless saying decline and you having to redo it by chip and pin really bothers you THAT much , then just use chip and pin exclusively.