Strong customer authentication (SCA) is the process that validates the identity of you the user when you log in to access online and mobile banking, and for further services such as making payments or changing your address.

From September you will be asked for additional security credentials. We will be sending you notifications to ask you to confirm that you have authorised payments, logged in or wish to make changes to your accounts.  We will also implement additional fraud prevention measures. Our online terms and conditions will be updated to take account of these changes.

From the 14th September when accessing your account or approving certain actions, you will be required to authenticate yourself using two out of three of the following:

• Something you know – i.e. password or PIN
• Something you have – i.e. mobile application
• Something you are – i.e. fingerprint or facial recognition

SCA came into effect on the 14th September 2019.

The second Payment Services Directive (PSD2) came into effect on the 13th January 2018 which contained 12 mandates. One of these mandates covered strong customer authentication, the Regulatory Technical Standards (RTS) which are effective from the 14th September 2019, details how the mandate should be implemented. Accordingly, all account providers, online retailers etc. are required to comply with these Standards.

SCA will be used when you do any of the following actions on your CU Online account:

• Access your account,
• Initiate a payment,
• Initiate an action which may imply a risk of payment fraud, such as creating a new payee.

No, the EU directive is mandatory, and all CU Online users will be required to complete SCA.

To make this change easier, check that your mobile phone number and personal details are up to date on your CU Online profile, or you can call into your local office.

The first Payment Services  Directive (EU) 2007/64/EC (PSD1), which came into force in 2009, established common rules for certain types of electronic payments, such as credit transfers, direct debits, card payments, and mobile and online payments.  Directive 2015/2366/EU on payment services (PSD2) updates and complements the rules set out in PSD1 and takes new providers of innovative payment services into account. The new rules seek to:

• Make it easier and safer to use internet payment services
• Better protect consumers against fraud, abuse, and payment problems
• Promote innovative mobile and internet payment services
• Strengthen consumer rights.