2

PSD2 requires two-factor authentication, which they call strong customer authentication (SCA). However, there is a “delegated regulation” 2018/389, Article 10, which adds an exception that SCA is not required to view account information, specifically the account balance and transactions from the last 90 days.

That article also has an exception to the exception stating:

  1. For the purpose of paragraph 1, payment service providers shall not be exempted from the application of strong customer authentication where either of the following condition is met:

    […]

    (b) more than 90 days have elapsed since the last time the payment service user accessed online the information specified in paragraph 1(b) and strong customer authentication was applied.

I would like to know how requiring SCA every 90 days improves security over not requiring SCA at all, at least for viewing account information.


As an example, for my bank, this means that the login to their online banking requires the second factor every 90 days. They even show a notification before the 90 days have expired so I can re-start the 90-day period early, which means that my account is always “activated”. This does not seem to be very uncommon, at least in Germany.

In fact, I feel this lessens security because the ChipTAN device that is my second factor only shows a cryptic “start code”, so I'm not sure if the action I'm authenticating is in fact a renewal of the 90-day period or something else. For example, when accessing transactions older than 90 days, I get the same “start code” prompt.

3
  • Doesn't the "90 days no 2FA" only apply to access made from the same terminal? All similar systems I have seen always demand 2FA if logging in from a new terminal.
    – Ben Voigt
    Commented Mar 8, 2021 at 21:16
  • @BenVoigt Nope, at least my bank doesn't. I've found a description of this at blog.fscom.co.uk/strong-customer-authentication-the-exemptions (“Payment account information (Article 10)”), but I have no idea where to find this Article 10, e. g. in the PSD2 text at data.europa.eu/eli/dir/2015/2366/oj
    – wrtlprnft
    Commented Mar 8, 2021 at 21:43
  • @wrtlprnft: See the link in my answer below.
    – mentallurg
    Commented Mar 9, 2021 at 0:22

1 Answer 1

2

TLDR:

  • If the bank is requiring 2FA every 90 days for login only, but requires it for every payment (see exceptions below, e.g. recurrent payments to the same receiver), then your bank seems to seek for balance between security and friendliness, and seems to be compliant with PSD2.
  • If the bank requires 2FA once every 90 days also for payments, then this very probably violates the PSD2 requirements and does not improve security.

Details:

The PSD2 defines what operations have higher risks and need a "strong customer authentication".

Where payment service providers apply strong customer authentication in accordance with Article 97(1) of Directive (EU) 2015/2366, the authentication shall be based on two or more elements which are categorised as knowledge, possession and inherence and shall result in the generation of an authentication code.

To put it simple, "strong customer authentication" is a multi-factor authentication, 2FA or stronger.

Mainly, this "strong customer authentication" is applicable to payments:

The requirements of strong customer authentication apply to payments initiated by the payer...

More security often means less friendliness and worse user experience. The PSD2 tries to find a balance.

... exemptions to the principle of strong customer authentication have been defined based on the level of risk, amount, recurrence and the payment channel used for the execution of the payment transaction.

Try to travel to Afghanistan or Marocco and login to your account. Very probably you will be asked for 2FA. Why? Because the rule above was applied: You are using other channel that has higher risk compared to access from your country.

The rule above defines basic principles. Briefly: risk estimation should take into account many different factors.

The PSD2 defines also exceptions. For instance:

Actions which imply access to the balance and the recent transactions of a payment account without disclosure of sensitive payment data, recurring payments to the same payees which have been previously set up or confirmed by the payer through the use of strong customer authentication, and payments to and from the same natural or legal person with accounts with the same payment service provider, pose a low level of risk, thus allowing payment service providers not to apply strong customer authentication.

This means that if you only login to your account and don't do any payments, your bank is not required to apply "strong customer authentication". Some banks require 2FA also for login. Your bank uses this formal right not to do that.

One of factors for such decision may be recurrence. Try to login 1000 times a day, even without doing any payments. I would suppose that your bank will require 2FA not after 90 days, but very shortly, after you have reached some number of logins that your bunk considers as suspicious.

The requirement mentioned above allows to see the recent transactions without "strong customer authentication". When you want to see your history older than 90 days your bank considers this as not recent transactions and, according to this rule, requires "strong customer authentication", in your case it requires 2FA.

Requiring 2FA every 90 days is not a requirement of PSD2, but decision of your bank. The security benefits of doing that are very small. An attacker that knows your PIN will just use it between these dates, and let say will add 10 days before and 10 days after the date when the next 2FA may be requested, and use your PIN 70 days freely. The only security benefit I see is that when the bank is asking for 2FA they can be sure that the TAN device is not stolen and you still have it. The banks that want to have balance between security and user experience ask for a 2nd factor not in a regular interval, but at some unpredictable moments. Thus the attacker would not benefit from knowing that the bank asks for the 2nd factor only once every 90 days. I suppose your bank does not consider that as a risk.

9
  • They only force 2-factor authentication every 90 days, when viewing transactions older than 90 days or when ordering an actual bank transfer. I don't think my bank is blatantly violating the PSD2 by doing this, so I don't agree with your edit to my question's title.
    – wrtlprnft
    Commented Mar 8, 2021 at 22:01
  • @wrtlprnft: The new title seems accurate whether it is conformant to regulations or not.
    – Ben Voigt
    Commented Mar 8, 2021 at 23:06
  • 1
    @wrtlprnft: Sorry that my answer was too short and that I have not explained the reason to change the title. Now I have extended the answer. To the title: PSD2 does not have requirement to ask for 2FA only once every 90 days. Why? Because PSD2 is seeking for balance between security and friendliness. See details in my answer above.
    – mentallurg
    Commented Mar 9, 2021 at 0:19
  • Thank you for your answer (I didn't downvote, by the way). See my edit, I think the 2FA-every-90-day rule is not a specific invention of my bank, but rather the minimum required by the PSD2. Most of the other 2FA triggers you mention (foreign IPs, excessive logins, randomness) seem to be rather easy to circumvent or to just retry later. I guess protection of unused accounts and where the user has lost their TAN device is a good thing, but can this really be the only reason for the 90-day rule? I still don't see how this is a balance because it has almost none of the security benefits of 2FA.
    – wrtlprnft
    Commented Mar 9, 2021 at 5:02
  • @BenVoigt Yes, mentallurg's title is a valid question, however not the one I intended to ask. I'm not surprised that some banks will do the minimum to be compliant with new regulations, but I really wonder if there is some merit to this 90-day requirement vs. no SCA at all that I'm not (yet) seeing.
    – wrtlprnft
    Commented Mar 9, 2021 at 8:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .