Signature on a paper slip from a payment terminal, as a factor in a two-factor SCA

Article 4 of Directive 2015/2366/EU (PSD2) defines ‘knowledge’ as ‘something only the user knows’, ‘possession’ as ‘something only the user possesses’ and ‘inherence’ as ‘something the user is’. Paragraph 34 of the EBA Opinion on the implementation of the regulatory technical standards on strong customer authentication (SCA) and common and secure communication, EBA-Op-2018-04 , states that behavioural biometrics may constitute inherence providing they comply with the requirements under Article 8 of the Commission Delegated Regulation (EU) 2018/389 . However, for approaches currently observed in the market where the merchant compares the signature of the payer on a paper slip with the signature on the card, a signature on a paper slip cannot be considered as a behavioural biometric as it would not meet the requirements of Article 8 of the Delegated Regulation, since the signature is not being read by access devices and software provided to the payer and the issuer cannot verify the payer’s signature as part of the authentication process. In addition, a signature on a paper slip does not constitute ‘knowledge’ as this is not something only the user knows or ‘possession’ as this is not something that the user possesses. Therefore it cannot be considered as a valid factor in a two-factor SCA under PSD2 and the Delegated Regulation.