Use of behavioural data for SCA

Can a Payment Service Provider (PSP) use behavioural data and auditable scores to apply Strong customer authentication (SCA) in a way that protects consumer privacy?

The EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06),  June 2019, clarified that inherence may include behavioural biometrics identifying the specific authorised user and that inherence relates to physical properties of body  parts, physiological characteristics and behavioural processes created by the body, and any combination of these.  The EBA gave examples of factors which constitute inherence, including fingerprint and face scanning, keystroke dynamics and the angle at which a user holds the device, adding that these could be used to authenticate PSUs provided the implemented approaches have a ‘very low probability of an unauthorised party being authenticated as the payer’.  In order to meet the criteria of behavioural biometrics under the EBA Opinion of June 2019, PSPs may have to obtain sensitive data about a Payment Service User (PSU) to create a behavioural biometric that can be used to identify the PSU. This may include information such as how a consumer navigates on a computer or webpage, capturing keystrokes, typing style and speed and how the consumer interacts with their device. This would allow a PSP (or its provider) to create a fingerprint of an online session and compare with a historical baseline to verify a consumer. Such solutions could require PSPs and third parties to obtain information from a user’s personal device (such as a computer or  mobile phone) by scraping the information or installing technologies that monitor a consumer’s use of a personal device.  There are additional concerns over the scope and definition of behavioural biometrics in the EBA Opinion of June 2019 in that: 1) some devices used for payments have been designed to protect consumer privacy by preventing third parties from capturing or accessing sensitive information such as keystroke dynamics or fingerprints; 2) some of the browser based solutions are not compatible with purchases within apps; and 3) allowing or encouraging third parties to capture information relating to "physical properties of body parts, physiological characteristics and behavioural processes” as contemplated in the Opinion could lead to solutions that profile individuals using sensitive information in conflict with the General Data Protection Regulation (GDPR), lending this to abuse or risk of compromise by malicious actors. It is possible for PSPs to obtain behavioural data and auditable behavioural scores about a PSU’s device, mobile number and account activity in a way that protects consumers’ privacy while preventing / reducing fraud.  This can be done without accessing or capturing sensitive information relating to an individual’s physical or body parts. We welcome clarification that PSPs can use behavioural data and auditable behavioural scores about a PSUs’ device, mobile number and account activity to verify a user and meet SCA requirements.