In January 2026, the European Central Bank updated its payment statistics with provisional data for the first half of 2025. The data recorded €161,000 in fraudulent remote card payments involving payment-order changes, even though Strong Customer Authentication (SCA) was used. This shows that authentication alone cannot prevent every type of payment fraud.
In this blog, we will discuss PSD2 compliance rules, SCA, payment API security, exemptions, benefits, mistakes, and a checklist. We will also cover how penetration testing can reveal weak spots in payment systems.
Key takeaways
PSD2 compliance is crucial in protecting digital payments, personal data, and account access with Open Banking security.
Strong Customer Authentication (SCA) means the use of at least two unique factors for relevant transactions.
There is a need to secure the open banking APIs by creating reliable interfaces, using appropriate certificates, and managing third-party access.
Eligible transactions can be exempted from SCA under various conditions such as low-value payments, TPA, and trusted payees.
Documentation required consists of risk policy and procedures, SCA, fraudulent activity reports, and security assessment.
Non-compliance risks fines, loss of money, and liabilities in case of fraud.
The process of penetration testing, fixing vulnerabilities, and repeated testing can expose security gaps.
Source: https://qualysec.com/psd2-c ...