european-union
Can a bank force you to use their app in order to use their services under the PSD2?
<p>An online bank I am using (Qonto) contacted my recently by email to tell me that I will not be able to use my account from 5th July unless I install their app in my phone. They say it is mandatory for PSD2 compliance.</p>
<p>While I understand PSD2 may enforce security mechanisms, it surprises me that under the EU, an open standard is not promoted/enforced for banks (like One-Time-Password/OTP mechanisms).</p>
<p>Enforcing to use their app could be discriminatory since it assumes you can install it in your device (you may not have a compatible phone). Also, being a proprietary app, it could be used to track information about you that you do not want to share with your bank.</p>
<p>Can a European bank do this? Wouldn't PSD2 protect users from this somehow?</p>

<p>The PSD2 <a href="https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32015L2366#d1e1374-35-1" rel="nofollow noreferrer">article 4(30)</a> defines multifactor authentication :</p>
<blockquote>
<p>‘strong customer authentication’ means an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data;</p>
</blockquote>
<hr />
<p>The <a href="https://www.eba.europa.eu/eba-publishes-an-opinion-on-the-elements-of-strong-customer-authentication-under-psd2" rel="nofollow noreferrer">EBA</a> published an opinion about the means of 2FA that are compliant with the Strong Customer Authentication of the PDS2</p>
<blockquote>
<p>it surprises me that under the EU, an open standard is not promoted/enforced for banks (like One-Time-Password/OTP mechanisms).</p>
</blockquote>
<p>OTP/TOTP is not a compliant way to conduct SCA because of :</p>
<blockquote>
<p>The EBA is also of the view that an OTP that contributes to providing evidence of possession would not constitute a knowledge element for approaches currently observed in the market. Indeed, knowledge, by contrast with possession, is an element that should exist prior to the initiation of the payment or the online access.</p>
</blockquote>
<p>TOTP would be compliant if it used a non-transferrable token that is only useable on that device alone (which a normal SOTP isn't) :</p>
<blockquote>
<p>As stated in the EBA Opinion on the implementation of the RTS (paragraph 35), a device could be used as evidence of possession, provided that there is a ‘reliable means to confirm possession through the generation or receipt of a dynamic validation element on the device’. Evidence could, in this context, be provided through the generation of a one-time password (OTP), whether generated by a piece of software or by hardware, such as a token, text message (SMS) or push notification. In the case of an SMS, and as highlighted in Q&amp;A 4039, the possession element ‘would not be the SMS itself, but rather, typically, the SIM-card associated with the respective mobile number’.</p>
</blockquote>
<hr />
<blockquote>
<p>Can a European bank do this?</p>
</blockquote>
<p>App-based auth is compliant because :</p>
<blockquote>
<p>The EBA is of the view that approaches relying on mobile apps, web browsers or the exchange of
(public and private) keys may also be evidence of possession, provided that they include a device-binding process that ensures a unique connection between the PSU’s app, browser or key and the device. This may, for instance, be through hardware crypto-security, web browser and mobile-device registration or keys stored in the secure element of a device</p>
</blockquote>
<hr />
<blockquote>
<p>Also, being a proprietary app, it could be used to track information about you that you do not want to share with your bank.</p>
</blockquote>
<p>You need to read the Privacy Policy of the app/service and exert your country/EU consent modification/retraction right</p>
<blockquote>
<p>Can a European bank do this?</p>
</blockquote>
<p>Why wouldn't they be allowed? There are many services that you can only access on a proprietary app.</p>
<blockquote>
<p>Wouldn't PSD2 protect users from this somehow?</p>
</blockquote>
<p>PSD2 gives security requirements, not anything else</p>
