Authentication
EMV 3-D Secure as it is specified and as it is run, and strong customer authentication from the RTS to the PSR.
-
№ 1 · 13 Oct
2 min readAuthentication Out of band
The human in the loop is already in the spec
When an AI agent buys something, how does the cardholder's bank get the cardholder to say yes? The published EMV 3DS specification already has an answer: a 3RI request answered with a decoupled challenge. What is missing is support and settled law.
-
№ 2 · 08 Sep
9 min readRegulatory
SCA gets a promotion
Strong customer authentication is being moved into a directly applicable regulation, not just amended. Your transition plan needs to separate what the text specifies, what waits on the EBA, and what it assumes about the handover. The law leaves that last part implicit.
-
№ 3 · 16 May
3 min readAuthentication
When “something you are” becomes “something they can make”
One in five biometric fraud attempts now involves a deepfake. The figure is striking on its own, but the more interesting story sits underneath it: inherence has quietly become the awkward leg of the SCA stool, and the trilogue text of the PSR is the first regulatory instrument to acknowledge it.
-
№ 4 · 16 Sep
4 min readAuthentication
The Trust Triangle Evolution: From 3-D Secure's Three Domains to AP2's Agent Architecture
Twenty-five years ago, the payments industry solved the trust problem of e-commerce with a three-domain architecture that became the backbone of online authentication. Now, as AI agents prepare to shop on our behalf, we're witnessing history rhyme. But this time, humans might not be in the loop.