Home / Starfish Blog / Article
Delegated Authentication: Seamless and secure online payments

Delegated Authentication: Seamless and secure online payments

Introduction

In the fast-paced world of e-commerce, providing customers with a simple, user-friendly checkout experience is vital to reducing cart abandonment rates and improving conversion. Delegated authentication is an innovative solution that enables merchants to authenticate customers themselves, paving the way for a seamless one-click checkout process. In this article, we'll discuss how delegated authentication works, its compliance with regulations such as PSD2 and SCA, the benefits it offers, and how to implement it effectively. Let's dive in!

How Delegated Authentication Works

Delegated authentication is a process that enables merchants to take on the responsibility of authenticating their customers, rather than relying on traditional payment service providers or card issuers to perform this task. This approach aims to create a more streamlined, secure, and efficient checkout experience, as merchants can tailor the authentication process to their customers' needs and preferences. Here's a detailed breakdown of how delegated authentication works:

  1. Adopting FIDO standards: The Fast Identity Online (FIDO) Alliance is an industry consortium that develops open and scalable authentication standards. By implementing FIDO standards, merchants can leverage various authentication methods such as biometrics, tokens, or one-time passwords, depending on the customers' devices and preferences. FIDO standards are widely supported by major payment networks, OEMs, and software providers, ensuring compatibility and widespread adoption.

  2. Customer registration: When a customer creates an account or makes a purchase on a merchant's platform, they go through a secure registration process that complies with FIDO standards. This process typically involves verifying the customer's identity through one or more authentication factors, such as biometrics or tokens. Once the customer is registered, their login credentials or biometric data are securely stored and linked to their account.

  3. Authentication during checkout: During the checkout process, the customer is prompted to authenticate themselves using the method established during registration. This can include entering a one-time password, scanning a fingerprint, or using facial recognition technology. The merchant's system then verifies the authentication data to confirm the customer's identity.

  4. Communication with card issuers: After the customer has been successfully authenticated, the merchant communicates this information to the card issuer using the 3-D Secure Protocol version 2.2. This protocol enables the secure exchange of authentication data between the merchant and the card issuer, allowing the issuer to authorize the payment transaction.

  5. Transaction approval: Once the card issuer receives confirmation of the customer's authentication, they can approve the transaction, allowing the payment to be processed. This streamlined process reduces the need for additional authentication steps or redirects, providing a seamless and frictionless checkout experience for the customer.

Compliance and Regulation (PSD2 and SCA)

Delegated authentication plays a crucial role in helping merchants and payment service providers (PSPs) comply with the Payment Services Directive 2 (PSD2) and Strong Customer Authentication (SCA) regulations. These regulations have been put in place to ensure a more secure, transparent, and competitive payment landscape across the European Union (EU). Here's a more in-depth look at these regulations and their implications for delegated authentication:

PSD2:

The PSD2 is a comprehensive regulatory framework that aims to foster innovation, increase competition, and improve security within the payment industry across the EU. The directive mandates that PSPs, including banks and payment processors, adhere to a range of requirements to safeguard consumers' financial information and ensure fair competition. Some key aspects of PSD2 include open banking, which requires banks to share customer data with authorized third-party providers, and the implementation of SCA for electronic payment transactions.

SCA:

SCA is a specific requirement under PSD2 that mandates the use of strong customer authentication for electronic payment transactions. The objective of SCA is to protect consumers from fraud by requiring them to provide at least two of the following three authentication factors:

  • Knowledge factors (e.g., passwords or PINs)

  • Possession factors (e.g., a mobile device or smart card)

  • Inherence factors (e.g., biometric data like fingerprints or facial recognition)

To achieve compliance with SCA, PSPs must ensure that SCA is used for all electronic payment transactions, except when exemptions apply, such as for low-risk transactions or transactions made with trusted merchants or entities. Additionally, the authentication factors used must be independent of one another, meaning the breach of one factor does not compromise the security of the others.

Compliance:

Delegated authentication can help merchants and PSPs achieve compliance with PSD2 and SCA regulations by allowing a third-party service provider to handle one or more of the authentication factors on their behalf. This approach reduces the burden of authentication for merchants and PSPs while maintaining the necessary security protocols.

For example, a merchant using delegated authentication may rely on a third-party service provider to manage the possession factor through a mobile device or smart card. The merchant would still be responsible for handling the knowledge and inherence factors, but the burden of managing the possession factor would be delegated to the third-party service provider.

By implementing delegated authentication, merchants and PSPs can ensure that they are following the appropriate security protocols, transmitting data securely, and meeting the regulatory requirements of PSD2 and SCA. As a result, delegated authentication not only streamlines the payment process but also plays a vital role in maintaining compliance with these critical regulations.

Which benefits provides Delegated Authentication?

Delegated authentication offers several advantages for merchants, payment service providers (PSPs), and their customers. By allowing a third-party service provider to handle one or more of the authentication factors, delegated authentication can enhance security, improve user experience, achieve regulatory compliance, and optimize operational efficiency. Here's a more detailed look at these benefits:

  1. Enhanced Security: By delegating authentication to a trusted third-party service provider, merchants and PSPs can minimize the risk of data breaches and fraudulent activities. Since sensitive payment credentials are not directly accessed or stored by the merchants, the risk of unauthorized access and theft is significantly reduced. Delegated authentication also helps protect against credential stuffing attacks by relying on a third-party provider's robust authentication infrastructure and expertise.

  2. Improved User Experience: Delegated authentication can streamline the checkout process for customers, making it more seamless and convenient. Instead of requiring users to enter multiple authentication factors each time they make a purchase, delegated authentication can allow customers to authenticate once and then access multiple services without additional authentication steps. This simplification leads to increased customer satisfaction and potentially higher conversion rates for merchants.

  3. Regulatory Compliance: As mentioned earlier, delegated authentication plays a crucial role in helping merchants and PSPs comply with the PSD2 and SCA regulations. By partnering with a third-party service provider, merchants and PSPs can ensure that they are meeting the required security protocols and effectively implementing strong customer authentication. This compliance not only protects consumers but also helps merchants and PSPs avoid potential fines and penalties associated with non-compliance.

  4. Operational Efficiency and Cost Savings: Delegated authentication allows merchants and PSPs to leverage the existing authentication infrastructure and expertise of third-party service providers. This reduces the need for building and maintaining in-house authentication systems, leading to cost savings on infrastructure and personnel. Additionally, the reduced burden of authentication can help lower costs associated with user support and account recovery.

  5. Scalability and Flexibility: By using delegated authentication, merchants and PSPs can benefit from the scalability and flexibility offered by third-party service providers. These providers often have the resources and expertise to handle large-scale authentication requirements and adapt to changes in regulatory landscapes or emerging security threats. This capability enables merchants and PSPs to focus on their core business while relying on a trusted partner for secure authentication services.

In summary, delegated authentication provides numerous benefits for merchants, PSPs, and customers alike. By enhancing security, improving the user experience, achieving regulatory compliance, and optimizing operational efficiency, delegated authentication is an essential tool in today's rapidly evolving digital payments landscape.

How to Implement Delegated Authentication?

Implementing delegated authentication requires careful planning and collaboration with a trusted third-party service provider. Some key steps to successfully implement delegated authentication are:

  • Selection of Third-Party Service Provider: Selecting the right third-party service provider is critical to the success of delegated authentication. Ensure the provider has the necessary expertise, industry experience, and a proven track record in offering secure authentication services. Look for providers that support multiple authentication methods, including biometrics and tokenization, and are compliant with PSD2, SCA, and other relevant regulations.

  • Scope of delegation: Clearly define the scope of delegation between your business and the third-party service provider. Determine which authentication factors will be delegated and which will be handled in-house. Establishing a clear division of responsibilities will help ensure a seamless integration and ongoing collaboration.

  • Integrate with your payment gateways and other systems: Integrate delegated authentication into your existing payment gateways and other systems. This may involve updating APIs, configuring authentication settings, and making necessary adjustments to your existing infrastructure.

Conclusion

In conclusion, delegated authentication is a powerful tool that can significantly improve the checkout experience for customers while ensuring compliance with regulations like PSD2 and SCA. By harnessing the power of advanced authentication methods, such as biometrics and tokenization, businesses can reduce friction during the checkout process, ultimately increasing conversion rates and customer satisfaction. Implementing delegated authentication requires careful planning, collaboration with a trusted third-party service provider, and ongoing monitoring and optimization. By taking these steps, businesses can seamlessly integrate delegated authentication into their payment systems, reaping the benefits of enhanced security, improved user experience, and regulatory compliance. As e-commerce continues to grow and evolve, delegated authentication will undoubtedly play a crucial role in shaping the future of online shopping and payments.

Back