We've released in-app payment verification for times when you can't use your PIN!

[milo (Milo Thompson)]

Hi Everyone ,

As I’m sure most of you are already aware we implemented new rules around contactless purchases almost a month ago now! You can find our previous post here if you missed it Since then we have been working hard to improve the experience and make sure you never get left unable to complete a transaction.

One of the key things we’ve identified is that some merchants in the EEA don’t yet support PIN entry, which means that you may be left unable to finish your transaction at the terminal

This tends to happen in one of two instances:

1. You hit your contactless limit when using a terminal that doesn’t have PIN entry capability, such as a vending machine
2. The merchant processes your transaction in such a way that requires us to perform Strong Customer Authentication (SCA) but they can’t accept your PIN

What’s changed?

There will be two noticeable changes to the app!

The first change is relatively minor. We’ve updated the contextual help article that is displayed when you get a decline for a related reason!

It should look a little something like this in your app:

The more significant change is the introduction of the new authentication flow. This flow will allow you authenticate yourself when you don’t have the option to use chip and PIN

You can find the flow by tapping on the decline widget for the transaction that just failed. You will then be given some contextual information before being asked to enter your PIN:

Once you have completed the flow you’ll have 15 minutes to make the same transaction. If the amount and or merchant are not exactly the same as before then your second attempt will still decline so watch out!

This is different from contactless declines outlined in the other post!

• There is no allowance. With contactless you have a £100 allowance before you will get declined. With the non-contactless declines, there is no such allowance and so a payment of this type will always get declined
• Different message at the terminal. With contactless you’ll usually see “insert card” at the terminals. With other types of declines, you’re more likely to see “not authorised” or “transaction not allowed to cardholder/issuer”.

What are we looking for feedback on?

As I mentioned previously, we’ve been working really hard to fine tune our new payment experience and keep it as smooth as possible.

We’re still in the process of making improvements to this new fallback flow so it would be super helpful if we could have your feedback on the following things:

• Does the flow make the process completely clear? If not, what were you unsure about?
• Are you ever incorrectly prompted to go through the flow?
• If you end up abandoning the transaction or using another card, what made you do this?

---

Let us know what you think below!

[alexs (Alex Sherwood)]

Am I right in thinking that we just won’t be able to make the payment if we don’t have data & this sort of decline happens because we won’t be able to go through this process in the app?

[erincandescent (Erin)]

In lots of cases it seems to be merchants operating their terminals wrong (chip & signature, chip without PIN, or even magstripe even though their terminal is chip and PIN capable). So in many cases they should retry with chip & PIN (especially if you ask them to)

Most vending machines support contactless, so if you’re not at your contactless limit you should be able to use that instead (or Apple or Google Pay).

Unfortunately yes, this retry flow won’t work if you don’t have any data

For what its worth, the fraction of these transactions that we process (and hence are now declining) is less than 0.1%

[edited201119]

Yes and I admit I do like the feature - makes it feel so much more secure.

[anthar]

i think the above process needs streamlining somewhat if possible, but perhaps trying in the wild will offer a better experience.

I hear that Revolut has implemented a feature to reset the SCA limit when close in-app this would re-arm the contactless card. I think this is a excellent idea and should be the highest priority feature above all else. Budgeting is great but we need banking features first but i digress.

[kolok]

On another thread staff have said that this isn’t compliant with SCA .

The reset has to be tied to an actual transaction is the problem if I remember correctly.

Edit:

Strong Customer Authentication: Using Chip and PIN more often when making contactless payments

It’s not clear this is a compliant approach. There is an EBA Q&A that very strongly suggests that you can’t do this. They make it clear that the SCA needs to be tied to a payment initiation, and generally prove the customer is still in possession of the card. Of course we’ll keep an eye on these sort of implementations to make sure we aren’t over interpreting the law. But right now our focus is on producing the most user friendly and complaint implementation. I would assume that other banks …

[lpoolrob (Rob)]

I suspect that this is one of those things which is easier to understand when it happens to you in real life, that to read about the theory. From what has been posted though, it seems like a good idea.

[anthar]

I couldn’t comment for certain but seem strange Revolut can do it, how i am not sure. But re-arming it is secure because you reauthorize in -app so its 2 factor you could argue. If your phone is secure enough to make direct payments using Apple/Google Pay then why is it not strong enough to re-arm a card? Its implementation would get around the annoyance of contactless SCA.

[kolok]

Yes I fully agree with your logic but I guess Monzo are sticking to the wording of the directive for now.

[Js38wju3jda]

How does the SCA account for contactless only terminals such as London Busses? Someone could really be caught out.

[Feathers (MikeF)]

Transport is exempt as stated earlier but I guess that assumes the transport organisation implements something correctly.

[Strangeling (George Hart)]

I have no issue with the idea behind this, but having contactless payments periodically declined is pretty inconvenient.
Getting a notification once you breach the £100 limit would help as you then know in advance to use Chip and Pin for your next purchase.
Even better, if it complies with whatever legislation, would be to have an option to authenticate through the app rather than having to make a chip and pin purchase.

[swok1080]

I’ve had a couple of notifications stating that I needed to use C&P on the next transaction as you describe.

On .

[Strangeling (George Hart)]

Interesting, I wonder why I didn’t get anything

[swok1080]

Finally remembered to capture a notification: