The national system of payment cards will encourage banks to pay online without SMS codes

The National Payment Card System (NSPK) plans to make two-factor authentication of a client paid for by banks when paying on the Internet – when it is necessary to confirm the payment with a code from SMS. So NSPK hopes to encourage banks to switch to a more modern technology for determining the device from which the buyer entered the site, which will simplify the customer journey and increase the speed of payment. But, according to experts, the transition to a new payment scenario may be more costly for banks than SMS.

As it became known to Kommersant, at the end of last week, the NSPK sent a draft of new tariffs to banks. One of the most notable changes was the introduction of an SMS authentication fee for online payments.

The commission for the issuer will be 20 kopecks. for the operation in any case, and for the acquirer it will be the same if the site of the store served by him was accessed from an Internet browser, and 10 kopecks. through a mobile application, but not more than 2.5 million rubles. per month for everyone.

As experts explained to Kommersant, the new 3D Secure 2.0 has two payment confirmation scenarios: with SMS (challenge) and without SMS (frictionless), if the bank recognizes the gadget from which the payment request came as the client’s main device. It is planned that these commissions will begin to operate from October 2023.

The NSPK told Kommersant that the advantages of the frictionless scenario are not only that it is cheaper for banks due to the lack of SMS, but also easier and faster for the cardholder. The scenario increases the security level of online payments through a comprehensive assessment of the risk level of the transaction based on the data transmitted by the merchant. When implementing frictionless authentication, a set of unique features of the device is used, the so-called fingerprint of the device. NSPK has provided several options for supporting the new scenario – all work on frictionless verification is performed by the payment system, or the bank can do everything itself. In the latter case, NSPK admits, the transition to frictionless may require serious time and financial resources.

As NSPK explained to Kommersant, a year has passed since the appearance of the frictionless scenario until the introduction of commissions stimulating its implementation. Nevertheless, banks are in no hurry to switch to it, which may be due to the complexity of setting up risk analysis. So, VTB told Kommersant that the bank is interested in applying the new scenario, since it allows significant savings on SMS notifications, but they expect to start transferring customers only in 2024.

Experts note that SMS verification has become a clear and familiar scenario for banks and cardholders over the years, which is partly why banks are in no hurry to switch to other security options. At the same time, for banks, the cost of SMS is constantly growing. Several systemically important players have once again increased the cost of SMS mailings this year. Now for these players it varies from 199 to 69 rubles. per month.

According to the head of the board of the Financial Innovations association Roman Prokhorov, in order to implement frictionless, banks must be able to determine the client’s trusted device and build the mechanism into 3DS. “At the same time, they still have to support both scenarios – with and without SMS, that is, instead of one basic technology, two appear, which does not contribute to high reliability,” he emphasizes.

“The new tariffs are not so critical for banks to force them to change their behavior, especially since they can always shift the tariff increase to the cardholder or online store,” Dmitry Vishnyakov, an independent expert in the payment card market, is sure. Experts estimate the cost of introducing frictionless at least tens of millions of rubles. The final amount, they say, could be in the billions, depending on the scale and complexity of the technology.

Maxim Buylov