Online Shoppers Face New Fraud Checks

From Monday online shoppers must verify their identity when making purchases online, as long-planned Strong Customer Authentication (SCA) checks are finally made mandatory for retailers and banks in order to reduce theft and fraud.

Under new Financial Conduct Authority (FCA) regulations, retailers must verify customers are who they say they are before accepting online debit and credit card payments. This may involve shoppers entering a password, PIN, or one-time code they have been sent through a text to their mobile or call to their landline. They might also be asked to log into their banking app and approve the purchase there, with a password, PIN, or digital fingerprint.

While most low-value transactions can proceed without the checks, shoppers trying to spend more than £25 may have their payments declined if they can’t verify their identity.

The checks are similar to those made mandatory for logging into online banking in March 2020. The rules, which came from the European Banking Authority and were adopted into UK law before Brexit, were supposed to be extended to online shopping a year ago, but the FCA delayed the enforcement to give businesses more time to adapt. 

Retailers and payment providers began rolling out the checks in June 2021 so you may have already been prompted to authenticate your identity.

As of Monday 14 March 2022, the Strong Customer Authentications are now required for transactions judged risky, such as high-value purchases, purchases outside of the buyer’s normal spending patterns, or done on a previously unused device. 

Under EU rules, payments under €30 (£25) are considered low value and won’t require authentication. However, exemptions mean transactions above that level won’t necessarily trigger SCA checks. Conversely, multiple low-value purchases could also trigger a request for verification.

Mastercard says it expects around 25% of online transactions to require authentication from Monday, compared to just 1% previously. Barclaycard said that in February of this year SCA checks stopped 1.2 million transactions worth more than £100 million. 

The checks are intended to detect and thwart fraudulent transactions, which have soared as consumers become more reliant on online shopping.

“Fraud is a growing problem, with criminals stealing more than £750m in the first half of 2021 alone,” said Jana Mackintosh, managing director of payments at trade association UK Finance.

"That is why it is more important than ever that additional protections like SCA are put in place. For retailers, implementing SCA will provide customers peace of mind that payment processes are more secure."

Retailers said the checks have been designed not to inconvenience shoppers and will boost their confidence in online purchases. 

Tom Ironside, director of business and regulation at the Business Retail Consortium (BRC), said: “Retailers have been working hard to prepare for the Strong Customer Authentication requirements, ensuring online purchases are both as safe and easy as possible. 

"The BRC and our members have worked with suppliers to ensure multiple fraud checks are performed behind the scenes and any addition friction is kept to a minimum. Customers should be reassured that buying online has never been safer," he added.

But consumer group Which? has been warning since 2019 that one in five consumers could struggle to pass SCA checks either because they don’t own a mobile phone or have poor mobile phone signal at home. The checks may also snare customers who haven't updated their contact details with their bank recently. 

The FCA appears to have considered those concerns and has told payments providers that they are expected to develop Strong Customer Authentication methods that work for all consumers. This might involve asking consumers to use their bank’s app over Wi-Fi or to verify their identity by relaying a code sent to their landline.

For example, Nationwide Building Society has told customers who don’t use the banking app that they can choose to receive a code through a message sent to their landline or opt to use their card reader and debit card. 

The building society has urged all customers to ensure it has the correct mobile number, landline, and email address for them, “so you’ll get any authentication codes we send quickly, and you won’t get interrupted while shopping online.”

However, some consumers may simply head to another retailer if they can't be bothered to authenticate their identity with one. Barclaycard's research found that in February, with the checks coming into force, 14% of shoppers had noticed an increase in their online payments being declined. 37% of those customers had moved to another retailer to get around the barrier.

Sources