Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Payments down 20% in my SaaS after EU introduced PSD2

globalbankingandfinance.com

Post reply on HN
Print view View original

81–90 of 121 posts

Re: Payments down 20% in my SaaS after EU introduced PSD2

#81

Post by Macha »

hocuspocus wrote: post #22

So, some VP at a fraud prevention company recommends merchants to avoid using 3DS and use a fraud detection platform, got it. I don't know if we can find better data somewhere else but I would assume that abandonment rates will decrease thanks to PSD2: - SMS tokens are finally on their way out; more and more people are installing their bank's mobile app, which is used as the second factor (you get a push notification…

So the effects of PSD2 I've noticed:

1. My bank now _requires_ SMS 2fa, for many actions like logging in, viewing transaction history > 1 month, or making purchases online.

2. My bank has killed their mobile web page in favour of their app. The desktop web page still works, but if you try visit it with a mobile UA you still get told to use the app.

3. Not 100% sure this is PSD2 related, but my bank have made their password policies less... dumb. It used to be max 8 chars, case insensitive, anything longer was silently truncated. In addition, the signup form used to allow alphanumeric characters, but the change password form only allowed alphabetical.

4. Presumably because of 1, they now no longer randomly decline transactions to smaller vendors. They used to then send you a text asking you to phone the fraud department to clear it. The first couple of times, I thought the text _was_ the fraud.

Now it's entirely possible my bank have just misinterpreted what's required of them, their prior actions show they aren't the most technically competent, but that's not what they were chosen for.

Re: Payments down 20% in my SaaS after EU introduced PSD2

#82

Post by pjmlp »

thefounder wrote: post #51
pjmlp wrote: post #40

Earlier quoted context omitted.

The main issue to SMS tokens going away are all those people, specially elderly ones, that now are forced to buy a phone they cannot understand how to deal with. Just like the clever idea some cities have had to initially only offer covid vaccination appointments over their website.

Well...if they use the internet to shop online a mobile app should not be that hard to deal with given it's installed/configured by the bank clerk. All the mobile phones are "smart phones" now anyway.

Plenty of dumb phones available at the shopping malls over here.

Besides the UX of the Internet is not the same as the phone and these are the kind of users that end up with the browser full of extensions trying to make pesky dialogues go away.

Re: Payments down 20% in my SaaS after EU introduced PSD2

#83

Post by summm »

hocuspocus wrote: post #22

So, some VP at a fraud prevention company recommends merchants to avoid using 3DS and use a fraud detection platform, got it. I don't know if we can find better data somewhere else but I would assume that abandonment rates will decrease thanks to PSD2: - SMS tokens are finally on their way out; more and more people are installing their bank's mobile app, which is used as the second factor (you get a push notification…

These apps are worse. Each of them has its own horrible interface and horrible surveillance functionality. For Android they usually check if you have an officially sanctioned and non-rooted google phone. If I wanted to be patronized by the phone manufacturer, I would buy apple... I indeed do want to have full control over my phone. It is a freedom we are gradually losing. RMS was right all along... But if course they do not care about actual security, that means if your phone has current security patch level. So for old phones with no official patches you can't even install Lineage and you're worse off.

Re: Payments down 20% in my SaaS after EU introduced PSD2

#84

Post by thefounder »

slaymaker1907 wrote: post #19
vineyardmike wrote: post #7

Very interesting to hear about the impact of this regulation on industries many here work in but I have many questions that were answered… What is PSD2? What is 3DS? Why do these exist and what did they solve? Edit: Thanks for the responses everyone!

The biggest thing with PSD2 seems to be the introduction of mandatory 2FA (CVC code/card number are not sufficient).

cvc has alaways been a joke

Re: Payments down 20% in my SaaS after EU introduced PSD2

#85

Post by Rafert »

hocuspocus wrote: post #22

So, some VP at a fraud prevention company recommends merchants to avoid using 3DS and use a fraud detection platform, got it. I don't know if we can find better data somewhere else but I would assume that abandonment rates will decrease thanks to PSD2: - SMS tokens are finally on their way out; more and more people are installing their bank's mobile app, which is used as the second factor (you get a push notification…

100%. 3DS is for card payments and using Netherlands and Germany as examples here is just plain bad - in these countries bank-based payment methods are more popular: iDEAL in NL (which has used 2FA for years), Sofort and Giropay in DE.

See: - https://www.adyen.com/knowledge-hub/guides/global-payment-me... - https://stripe.com/en-us/payments/payment-methods-guide#paym...

Re: Payments down 20% in my SaaS after EU introduced PSD2

#86

Post by mattmanser »

codethief wrote: post #24

I absolutely hate 3DS, for two reasons: 1) I now have to do the 3DS procedure for amounts as small as 1,80€ 2) My bank's 3DS "website" requires me to enter my online banking PIN (the one for my entire account, not just my credit card PIN!) and since that website gets opened in an Android WebView I can't even be sure that the app invoking the WebView doesn't actually obtain my PIN through a key logger. Fantastic.

In the UK they introduced it ages ago, and have now changed it so it remembers your IP and browser, so it never, ever asks for the pin now.

Kinda defies the point, and makes it very easy to forget the code as I put it in like once a year.

But there is less friction, you click buy, it redirects somewhere else (fairly slowly, perhaps by design), then done.

Re: Payments down 20% in my SaaS after EU introduced PSD2

#87

Post by sib »

hocuspocus wrote: post #22

So, some VP at a fraud prevention company recommends merchants to avoid using 3DS and use a fraud detection platform, got it. I don't know if we can find better data somewhere else but I would assume that abandonment rates will decrease thanks to PSD2: - SMS tokens are finally on their way out; more and more people are installing their bank's mobile app, which is used as the second factor (you get a push notification…

>> more and more people are installing their bank's mobile app, which is used as the second factor (you get a push notification, you have to unlock and accept the transaction

Great - so much for those times where I've been traveling internationally, been able to make a purchase using a web page hosted on a shared computer or one owned by a companion, but don't have mobile phone access to get a push notification.

Thanks, regulators!

Re: Payments down 20% in my SaaS after EU introduced PSD2

#88

Post by cabirum »

3DS is a type of 2FA that makes stolen card credentials harder to use. It does not replace but augments existing antifraud techniques.

3DS is merely a positive marker for antifraud system. This means a 3ds transaction is less likely to trigger antifraud rejection, and antifraud declines are the reason for user abandonment - you can't simply retry a payment attempt in that case.

Re: Payments down 20% in my SaaS after EU introduced PSD2

#89

Post by lxgr »

Rafert wrote: post #85
hocuspocus wrote: post #22

So, some VP at a fraud prevention company recommends merchants to avoid using 3DS and use a fraud detection platform, got it. I don't know if we can find better data somewhere else but I would assume that abandonment rates will decrease thanks to PSD2: - SMS tokens are finally on their way out; more and more people are installing their bank's mobile app, which is used as the second factor (you get a push notification…

100%. 3DS is for card payments and using Netherlands and Germany as examples here is just plain bad - in these countries bank-based payment methods are more popular: iDEAL in NL (which has used 2FA for years), Sofort and Giropay in DE. See: - https://www.adyen.com/knowledge-hub/guides/global-payment-me... - https://stripe.com/en-us/payments/payment-methods-guide#paym...

At least the German services also need 2FA these days, though (since they access bank accounts, which require 2FA for all outgoing payments as well).

Re: Payments down 20% in my SaaS after EU introduced PSD2

#90

Post by Merem »

Don't have a mobile phone, so I guess I would count towards those numbers. A shop branch I used to buy at had 3-D Secure for years but after asking nicely, they disabled that authentification for me. However, ever since they merged with the main website earlier this year, it's no longer possible. So theoretically, it would be impossible for me to buy anything anymore...if not for the fact that they now allow you to buy "points" via PayPal with which you can then buy products in the shop. It's more complicated, takes longer and has other disadvantages (such as not buying the products directly) but for now, it works. Other websites which don't have such a workaround will simply end up with an "abandonment".
Post reply on HN