Failed Authentication Code

Please clarify under what circumstances Article 4 Paragraph 3(a) of the Regulation (EU) 2018/389 – RTS on SCA and SC might it be impossible to apply in remote authentication where SMS based One time passwords (OTPs) are used as the authentication method.

I wish to clarify my interpretation of Article 4 Paragraph 3(a) of the Regulation (EU) 2018/389 – RTS on SCA and SC. This is because the failure to generate an authentication code will always show that the knowledge element of the authentication (the customer’s ID and Password combination) will be exposed to an attacker The common interpretation of Article 4 Paragraph 3(a) is that it is referring to what is often called in the information security community as preventing “verbose reporting”. In other words preventing extraneous detail being presented on a failed log-on that might impart information to an attacker to refine his attack. As I stated this is a sound control to have in most computer systems during a log-on process. The reason that implementing SMS based OTP may find it impossible to meet this article is that it must be a two step process. One can never make SMS OTP a single authentication step where both knowledge and Authentication Code are presented at the same time. In the first step there is some form of authentication based on an ID and password before the SMS OTP is sent to the customer. This is necessary because the entity authenticating the customer first needs to conduct an internal look-up to recover the user’s mobile telephone number that has been registered for that account in order to send the SMS OTP authentication code to that user. Therefore the entire authentication exchange taking place fails to meet the intent of this article because the attacker will gather information during his attack; namely that the ID and password combination are in sufficient for him to be sent an authentication code. However it is true to say that an SMS OTP authentication solution can met the intent of this article for the initial ID and password check to request an SMS OTP authentication code.