Strong customer authentication (SCA), introduced by PSD2, has done a great deal to reduce unauthorised fraud — payments made by someone who is not the account holder. But a huge and growing share of losses comes from authorised payments: the genuine customer, properly authenticated, sends money to an account they believe is correct but is not. SCA cannot help there, because the payer is exactly who they claim to be.
Two questions, two controls
- SCA asks: is this really the account holder initiating the payment?
- VoP asks: does the destination account actually belong to the intended payee?
- A scam victim passes SCA perfectly while sending money to a fraudster.
Why you need both
Authentication and payee verification protect different stages. One secures the identity of the person paying; the other secures the destination of the funds.
- 1 SCA at initiation confirms the payer and reduces account takeover and unauthorised fraud.
- 2 VoP before authorisation confirms the payee and reduces misdirected and authorised push payment fraud.
- 3 Together they close both the 'who is paying' and 'who is being paid' gaps.
Strong auth is not strong enough alone
A perfectly authenticated payer can still be tricked into paying a fraudster. Verification of Payee is the layer that addresses that, which is why the Instant Payments Regulation mandates it separately.
RoxPay's Verification of Payee complements your existing SCA, adding the payee-side confirmation that authentication was never designed to provide.