5 ms·
The PSD2 is extremely user hostile. In fact, it's so universally hated that Switzerland's banks (not in the EU) have called it an "experiment at the customer's
by Longhanks 7y ago
The PSD2 is extremely user hostile. In fact, it's so universally hated that Switzerland's banks (not in the EU) have called it an "experiment at the customer's cost, creating dangerous confusion while undermining the security of customer's data" (https://www.swissbanking.org/de/themen/digitalisierung/open-banking-und-standardisierte-schnittstellen-api-1/payment-service-directive-psd2 https://www.swissbanking.org/de/themen/digitalisierung/open-...).
As a EU citizen myself that now has to live with an incredibly disrupting online banking experience, I am more than unhappy with the EU's regulations.
- tpush 7y agoDo you have any concrete criticisms? How is the online banking experience "incredibly disrupting"?
- carstenhag 7y agoThe current PSD2 implementation at most banks is just terribly annoying. On things which require authentication every 90 days (like checking the balance via api), almost all banks require one after every attempt/api call. Even worse: Many banks don't support their app's 2FA for the api calls, but instead the old tan lists. (ING does this AFAIK)
- dvfjsdhgfv 7y ago> As a EU citizen myself that now has to live with an incredibly disrupting online banking experience How so? For most people PSD2 means 2F auth not just for money transfers but also for login, which is quite good for security in general, although of course won't help in all cases (like SIM swap).
- WA 7y agoBecause some banks (Consorsbank for example), take this to an extreme and ask you to 2FA all the time for every login. I used to refresh several bank accounts several times per day through a third party app (MoneyMoney) on the Mac. This worked pretty flawlessly until September. Now, I have to take out my phone and 2FA all the things in three different apps. Of course, partially, Consorsbank is to blame here, because they fucked this up. Other banks have more customer-friendly interpretations on how often you have to 2FA (like once per month). Only thing I noticed: I used to automatically fetch transactions through a HBCI interface with the open source software AqBanking on a VPS. This doesn't work anymore, because you need to register this software somewhere. So not sure how this is connected to PSD2 exactly. I assume the requirements for HBCI got tightened.
- supermatt 7y agoDefinitely a problem with your bank(s). SCA is only required for high risk activities, such as payments (and even then, only if amount is over €30 or if you have transacted over €100 since last SCA). Balances and recent transactions are considered low-risk, so you shouldnt need to enter 2FA for "refreshing" your account balances, etc. The directive also states that a balance must be made between security and user experience. It seems your bank(s) ignored that part.
- campl3r 7y agoBut which bank doesn't? I have N26, DKB, 1822direkt and they all have gotten much worse. If I could, I would opt out.
- carstenhag 7y agoI have also used N26, ING and DKB, which are mostly the best/most modern banking experiences in Germany and can only confirm what you said.
- lxgr 7y agoNo, SCA also applies for account access. Banks are allowed (but not required!) to only require SCA once every 90 days. This is something where the technical regulation falls short, though. They (i.e. the EBA, which I believe specified the technical part of PSD2) could have specified some minimum usability requirements for delegated account access APIs. Having to do SMS-based 2FA every single time when using a third party client compared to being able to use Face ID for the bank's native app is probably not really the intended outcome, but the reality for my two main bank accounts.
- supermatt 7y agoYes, I am aware that you need to re-authenticate every 90 days. My comment was specifically in response to GP being requested for SCA multiple times per day to refresh their accounts.