Out of band Out of band

Chat and app orders are not MOTO

Under the Council’s first-reading position on the PSR, an order a customer types into a web chat or an app is not a MOTO transaction and cannot skip SCA as one. Only an order placed off-line qualifies.

Matt Berryman 2 min read
Chat and app orders are not MOTO
Photo by Quino Al / Unsplash

Under the Council's PSR position, an order a customer types into a web chat or an app is not a MOTO transaction, and cannot skip SCA as one.

The test is how the order was placed. Only that step must be off-line.

PSD2 and the RTS on SCA never mention mail or telephone orders. The Council text defines them in Article 3(68): payment orders placed by the payer "using means other than the use of electronic platforms or devices, such as paper-based payment orders, mail orders or telephone orders, irrespective of whether or not the execution of the transaction is performed electronically".

Recital 158 gives the reason and draws the line. MOTO and merchant-initiated transactions are "diversely understood and applied and are subject to abusive reliance", and only the placement of the order, "and not also its authentication or execution", has to be non-digital.

I read that against the orders merchants actually take. A card number read out on a call to your contact centre still qualifies when a colleague keys it into a terminal. The same card number typed into a chat window, sent through a messaging app or handed to a shopping agent in an app does not, because the customer placed the order through an electronic platform or device.

Genuine MOTO is not a free pass either. Article 91(5) keeps it out of SCA only "provided that security requirements and checks are carried out by the payer's payment service provider allowing a form of authentication of the payment transaction".

Last week I wrote that an agent's purchase cannot run as a merchant-initiated transaction. The same text closes the MOTO route for orders typed into a chat or an app. For those, the route that holds is the one you already run for e-commerce: a payment link the customer completes, authenticated like any other online payment.

The Council adopted its first-reading position on 29 October, so none of this is law yet, and PSD2 still applies with no definition at all.

If you take orders over chat or messaging today: how are they flagged by the time they reach your acquirer?

This post is from Out of band, the shorter arguments I make on LinkedIn between essays, kept here with their sources. For the long form, read the essays.