CLAIM-2026-08-04-06
Under Directive (EU) 2015/2366 (PSD2), strong customer authentication is authentication based on "two or more independent elements categorised as knowledge (something only the user knows), possession (something only the user has) and inherence (something the user is)", and Article 97(1) requires payment service providers to apply it where the payer accesses a payment account online, initiates an electronic payment transaction, or carries out any other remote action implying a risk of unauthorised or fraudulent access.
Why it matters
A stored password is a single knowledge element. An agent replaying it satisfies one factor and cannot supply the second on its own, which is why the payment boundary is a hard line in the EU rather than a product preference.
Sources
- eurlex2015directive