EBA · 2021_5821 Final Q&A

Strong customer authentication (SCA) Knowledge element: Place of Birth and Date of Birth

Regulation
Directive 2015/2366/EU (PSD2)
Article
4, para. 30
Topic
Strong customer authentication and common and secure communication (incl. access)
Submitted by
Other
Submitted
2021-04-21
Answered
2021-07-30
Answer provided by
ESAs (EBA, ESMA, EIOPA)
Browse PSD2 Register → More Q&As on this regulation →

Question

Does a payer’s date of birth and place of birth constitute a valid Knowledge Element for strong customer authentication.

Background

After reading many different articles, Knowledge should be something in the customers head. So if a date of birth can be viewed across many different forms of personal information (even through the window of some letters in your letterbox or my facebook page) and my Place of birth can be found on my passport., Should my bank be using this to validate Knowledge for making data changes?

Answer

Article 4(30) of Directive 2015/2366/EU (PSD2) defines knowledge as something only the user knows.   Article 6 of Regulation (EU) 2018/389 specifies the requirement for payment service providers (PSPs) to mitigate the risk that the element is ‘uncovered by, or disclosed to, unauthorised parties’ and to have mitigation measures in place ‘in order to prevent their disclosure to unauthorised parties’.   Accordingly, date and/or place of birth cannot constitute a knowledge element under PSD2 and the Delegated Regulation since these may be accessible by third parties other than the payment service user or the PSP.

Original source: European Banking Authority, Q&A ID 2021_5821

This Q&A is published by European Banking Authority and is non-binding. It does not constitute legal advice. Updated weekly from official ESA sources.

Similar Q&As

Association with the payment service user by means of a remote channel

Answered 2021-09-24

Knowledge element of SCA.

Answered 2025-08-29

Independence of the elements for SCA

Answered 2021-04-23

Elements of possession (SIM card) and knowledge (knowledge-based responses to challenges or questions)

Answered 2021-11-05

Use of new technology for SCA

Answered 2021-04-23

More Q&As on this topic

Definition of "equivalent authentication procedure" for journeys initiated from a mobile application

Answered 2026-06-12

Obstacle assessment of a mandatory client segment selection screen in a redirection journey

Answered 2026-06-12

Clarification of the scope of the term "authentication procedures" in the context of the RTS and the EBA Opinion on obstacles

Answered 2026-06-12

SCA exception for Contactless only terminals (SoftPOS) in case of emergency

Answered 2025-10-03

the use of strong and widely recognized encryption techniques

Answered 2025-10-03

📋 Track EU financial regulation continuously

Forseti monitors EU financial regulation and delivers personalised alerts anchored to verified official sources.

Start free trial → Learn more

14-day free trial. No credit card required.