5 ms·
Definitely a problem with your bank(s). SCA is only required for high risk activities, such as payments (and even then, only if amount is over €30 or if you ha
by supermatt 7y ago
Definitely a problem with your bank(s).
SCA is only required for high risk activities, such as payments (and even then, only if amount is over €30 or if you have transacted over €100 since last SCA). Balances and recent transactions are considered low-risk, so you shouldnt need to enter 2FA for "refreshing" your account balances, etc.
The directive also states that a balance must be made between security and user experience. It seems your bank(s) ignored that part.
- campl3r 7y agoBut which bank doesn't? I have N26, DKB, 1822direkt and they all have gotten much worse. If I could, I would opt out.
- carstenhag 7y agoI have also used N26, ING and DKB, which are mostly the best/most modern banking experiences in Germany and can only confirm what you said.
- lxgr 7y agoNo, SCA also applies for account access. Banks are allowed (but not required!) to only require SCA once every 90 days. This is something where the technical regulation falls short, though. They (i.e. the EBA, which I believe specified the technical part of PSD2) could have specified some minimum usability requirements for delegated account access APIs. Having to do SMS-based 2FA every single time when using a third party client compared to being able to use Face ID for the bank's native app is probably not really the intended outcome, but the reality for my two main bank accounts.
- supermatt 7y agoYes, I am aware that you need to re-authenticate every 90 days. My comment was specifically in response to GP being requested for SCA multiple times per day to refresh their accounts.