Topic starter
07/03/2026 1:03 am
TL;DR: PSD2 requires strong customer authentication, dynamic linking, and open banking access controls for online payments in the EU, and Beyond Identity argues passwordless authentication can satisfy two-factor requirements by binding identity to the device and local biometric confirmation. The real issue for practitioners is not whether compliance is possible, but whether current login and transaction flows can prove possession, inherence, and transaction integrity without adding avoidable friction.
Editorial analysis by NHI Mgmt Group, based on content published by Beyond Identity: “PSD2 Compliance Requirements: How to Meet Them with Passwordless Authentication”.
Key questions
A: Use at least two independent factors from knowledge, possession, and inherence, then apply them only when the transaction risk justifies it.
Q: Why do payment flows need dynamic linking when strong customer authentication is used?
A: Dynamic linking binds the authentication code to the exact payment amount and recipient, which prevents attackers from altering a transaction after approval.
Q: What breaks when payment access still depends on reusable passwords?
A: Reusable passwords keep the account takeover path open, especially when attackers can phish, reuse, or recover credentials through weak fallback processes.
Practitioner guidance
- Map checkout flows to PSD2 factor requirements Document where possession, inherence, and transaction-specific approval are proven in the payment journey.
- Bind payment approval to amount and payee Require dynamic linking so any change to the recipient or amount invalidates the approval code and forces reauthorisation.
- Replace reusable passwords in payment access Use device-bound credentials with local user verification so the primary login path cannot be replayed or phished like a shared secret.
Bottom line: PSD2 is not just a compliance checkbox, because it changes how identity must be proven inside payment flows.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
08/10/2026 4:56 pm
PSD2 turns payment login into a transaction-integrity control, not just an authentication control. The article is really about where checkout identity proves the legitimacy of a payment, not merely the legitimacy of a session. That distinction matters because payment risk is created when approval and identity drift apart. Practitioners should treat the payment flow as part of the identity plane, not a downstream UI step.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: What is the difference between MFA and PSD2 dynamic linking?
A: MFA proves the user at login, while dynamic linking proves that the user approved this specific amount for this specific payee. A payment flow can have strong authentication and still fail PSD2 if the approval is not bound to the transaction details. The two controls solve different problems and should not be treated as interchangeable.
👉 Read our full editorial: PSD2 compliance and passwordless authentication for payment access