Most travel firms are not ready to meet the deadline for Strong Customer Authentication (SCA) requirements for online payments across Europe at the end of this year.
That is according to research by Amadeus which found two out of three firms (66%) are not ready for the December 31 deadline, raising fears that many transactions may have to be abandoned during the payment authentication process.
Two thirds of travel payment respondents in the survey said they believe SCA will increase the abandonment of transactions.
The Amadeus study, released today, suggests the Covid-19 pandemic has set back preparations for the SCA requirements, with 65% of travel firms citing the crisis as the biggest challenge to preparing compliance and 55% a lack of internal resources.
Amadeus found SCA implementation at 60 major businesses, including airlines, hotels and travel agencies, has been delayed by an average six months.
The SCA requirements are the final part of the EU’s Payments Services Directive II (PSD2) of 2015 to come into force.
These are aimed to prevent card fraud, but involve a significant change to online payments.
The requirements officially came into effect in September 2019, but the European Banking Authority delayed enforcement.
Card-issuing banks are now expected to enforce the requirements across Europe from the end of this year.
SCA means the vast majority of online payments within in the European Economic Area (EEA), including the UK, will be subject to two-factor authentication.
This will require, for example, that a purchaser enter a one-time passcode sent to their phone along with their payment card details.
Amadeus notes: “This has significant implications in travel where bookings often involve multiple merchants in a single transaction and there are many players in the distribution chain that must each play a role in making SCA checks happen.”
The research found only one third of travel firms expect to be ready to apply SCA checks across all sales channels by December 31.
A further one in four firms said they were likely to be ready in the first half of 2021.
The survey suggests a majority had expected SCA requirements to be delayed again due to the impact of the Covid crisis.
However, the Amadeus report notes: “A great deal of progress has been made recently: with the new 3DS 2 authentication protocol now available, the industry can access the function-rich technology it needs to deliver SCA in a wide variety of scenarios.”
The report makes a series of recommendations, suggesting travel companies:
Map specific payment flows: including payments and technical intermediaries that will be required to upgrade systems to make SCA happen.
Migrate to 3DS 2: for e-Commerce payments “it’s recommended travel companies move their direct channels to the latest industry authentication protocol which helps prevent fraud while protecting the customer experience”.
Amadeus argues: “This is particularly important for travel agents and suppliers involved in ‘multi-merchant’ bookings like package holidays, where 3DS 2 uses ‘dynamic linking’ to improve authentication.”
Understand use cases: “planning for SCA requires travel agents and suppliers plot specific use cases in advance to facilitate decision making, such as whether a travel agent should become the ‘merchant of record’ or pass the payment to the travel supplier to process”.
Plan for Merchant Initiated Transactions (MITs): “these transactions are critical in travel, allowing the traveller’s card to be charged when the traveller isn’t present”, such as for a cancellation or to pay a hotel bill.
“SCA requires travel suppliers and travel agents to present clear T&Cs at the time of booking as well as ensuring proof of SCA so MITs can be initiated later.”
Collaborate to benefit from exemptions: such as the Secure Corporate Payment exemption.
The research was carried out online with payments experts from 60 travel companies between June and October 2020. Most respondents (85%) were drawn from large firms with a minimum $100 million in annual revenue. More than half were at firms with $1 billion or more in revenue.