Continued from page 96
is when the 3D-Secure system kicks in. If the bank recognises you, it may authenticate you. Te method is down to the bank. “Most UK transactions are
like that today. You might see something pop up on screen and it disappears without asking for a password. Or it will send a one-time password and ask you to enter it. “In the UK, most
verification is ‘passive’, but in Spain and Germany most transactions involve more active authentication. But from September 14, any intra-European transaction above €30 [£30] will be subject to two-factor authentication.” Lacour insisted: “Amadeus
will be ready for this as a payment provider and as a GDS. As a GDS, we are upgrading all our systems to take authentication data and pass it on [and] all systems will be ready.” Te company acts as a
payment provider “mainly for airlines but also for agents”. He said: “We are upgrading the 3D Secure [3DS] offer to make it compatible with the latest protocols.” He calls this 3DS 2.0. He noted: “Tere are
exceptions [to SCA]. One is for ‘white listing’. A card will ask if you want to list a ‘preferred merchant’ and transactions will not be subject to two-factor authentication. Each card would trigger a request from an issuer to register the merchant. A second is ‘transaction risk analysis’ – if a card issuer or acquirer concludes you have a low fraud risk.” But he said: “We encourage
customers to be ready. For those not ready, it would be bad to see every transaction declined.”
UK’s FCA pledges ‘extra time’ to meet SCA deadline
Te UK’s Financial Conduct Authority confirmed it would “give some firms extra time” to introduce Strong Customer Authentication (SCA), noting: “Te deadline for complying remains September 14. “However, the FCA recognises
the challenges in meeting this deadline. We aim to quickly
agree a plan with stakeholders, a timetable for achieving this and key milestones and targets.” Yet the FCA warned: “We will
take enforcement action against firms if they do not meet the relevant requirements for SCA from September 14.” Its views echo those of the
European Banking Authority, which has acknowledged concerns about the deadline. It noted last month: “Te
complexity of payments markets across the EU . . . may lead to some actors in the payments chain not
being ready by September 14.” National agencies may therefore
“decide to allow limited additional time . . . [on] condition that payment service providers have a migration plan and will execute the plan in an expedited manner”. However, the EBA also insisted:
“Sufficient time has been available for the industry to prepare for the application date of SCA, given the definition of SCA was set out in Payment Services Directive 2 (PSD2) in 2015 [and] PSD2 already granted an extra 18 months for the industry to implement SCA.”
TMCs enjoy exemption but await ‘flagging’ tool
Ian Taylor
Strong Customer Authentication (SCA) will pose a challenge in corporate travel, although the sector enjoys an important exemption. SCA means two-factor
authentication will be needed for all online transactions of £30 and above from September 14. Amadeus head of merchant
services Jean-Christophe Lacour said: “Tere is an exemption for ‘secure corporate payments’ for corporate or stored cards [also called lodge cards] in online booking tools.” Te challenge is that travel
management companies (TMCs) need to flag transactions to benefit from the exemption and Lacour acknowledged: “Tere is no such flag [mechanism] on a GDS now.” He said: “Iata and the GDSs
acknowledge we need to work on this. [Te issue is] how do we communicate the context of a
94 25 JULY 2019 18
Months before a ‘system of flagging’ is likely to be in place
transaction so it is recognised by the [card] issuer as an exemption. We need a common system of flagging – a standard.” A solution should be in place “in
18 months to two years”, he said, adding: “It is complicated technically, but we probably have 18 months [to do it] in the UK. We are all working on upgrading our systems. “In the short term, TMCs will
continue as today, with a majority of transactions flagged as mail or phone order which are out of the scope of the regulation.” He added: “Issuers are aware
TMCs do business with stored cards. Most will recognise a TMC customer
even if the regulation is enforced from September 14.” A stored or ‘lodge’ card is a corporate card ‘lodged’ with a TMC. However, Lacour said: “A
[corporate] cardholder may not be present when a transaction is triggered. If the TMC takes the regulation literally, it may have to call the client and ask them to log on to authenticate themselves. In practical terms, that is what we are talking about. Te industry needs a period to turn this around.”
travelweekly.co.uk
PICTURE: Shutterstock
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53 |
Page 54 |
Page 55 |
Page 56 |
Page 57 |
Page 58 |
Page 59 |
Page 60 |
Page 61 |
Page 62 |
Page 63 |
Page 64 |
Page 65 |
Page 66 |
Page 67 |
Page 68 |
Page 69 |
Page 70 |
Page 71 |
Page 72 |
Page 73 |
Page 74 |
Page 75 |
Page 76 |
Page 77 |
Page 78 |
Page 79 |
Page 80 |
Page 81 |
Page 82 |
Page 83 |
Page 84 |
Page 85 |
Page 86 |
Page 87 |
Page 88 |
Page 89 |
Page 90 |
Page 91 |
Page 92 |
Page 93 |
Page 94 |
Page 95 |
Page 96 |
Page 97 |
Page 98 |
Page 99 |
Page 100
