How authentication works
A claim of identity is tested against something registered earlier. The evidence falls into three kinds, called factors:
- Knowledge: something the user knows, such as a password or a PIN
- Possession: something the user has, such as a phone, a card or a security key
- Inherence: something the user is, such as a fingerprint or a face
Where a payments or banking product authenticates
A product authenticates in several places: sign-in to the app, approval of a payment, a change of sensitive details, and staff access to the back office. Systems authenticate each other as well, with keys and certificates.
In the EU, PSD2 requires strong customer authentication when a payer accesses a payment account online or initiates an electronic payment (Article 97). In card payments, 3-D Secure carries the issuer's authentication of the cardholder into an online checkout.
What makes authentication weak or strong
A password alone fails to phishing and to reuse across sites. Strength comes from combining factors of different kinds, from evidence that cannot be replayed, such as a signature over a fresh challenge, and from how the factor was registered in the first place.
Recovery is part of the design: a reset by email undoes whatever protects the sign-in.
Authentication, identification or authorisation?
- Identification
- Establishes who a new customer is, once, at onboarding. Authentication confirms on each later visit that the same person has come back.
- Authorisation
- Decides what an authenticated person may do. In card payments the word also means the issuer's approval of a single payment.
- Strong customer authentication
- The legal standard in EU payments: two or more independent factors of different kinds.
Where authentication shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- BackofficeOne console to run the platform: customers, money, risk, content and staff permissions.
Platforms that need it
Where it is written
The laws and standards this page's facts come from.
- Directive (EU) 2015/2366, PSD2, Articles 4(29), 4(30) and 97 (EUR-Lex)
- PCI SSC, Glossary: Authentication
General information, not legal advice: what applies to you depends on your services and your market.