So, the European Banking Authority (who wrote PSD2) have thought about this. The Directive mandates "Secure Customer Authentication" (SCA) which is pretty expli

So, the European Banking Authority (who wrote PSD2) have thought about this. The Directive mandates "Secure Customer Authentication" (SCA) which is pretty explicit about levels of security. It basically extends multi-factor authentication to all sorts of existing and new payment vectors. Here's a fun doc if you're interested: https://www.eba.europa.eu/documents/10180/1761863/Final+draft+RTS+on+SCA+and+CSC+under+PSD2+%28EBA-RTS-2017-02%29.pdf https://www.eba.europa.eu/documents/10180/1761863/Final+draf...