{"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2018-10-05","gaps":[],"covered":["EBA Q&A 2018_4041 — Q&A — Display of incorrect authentication factors in case [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4041-display-of-incorrect-authentication-factors-in-case-of","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4041-display-of-incorrect-authentication-factors-in-case-of","title":"EBA Q&A 2018_4041 — Q&A — Display of incorrect authentication factors in case [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4041-display-of-incorrect-authentication-factors-in-case-of","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 5 October 2018","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4041","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"06edf504aca4fae0","change_date":null,"nearest_versions":["2018-10-05"],"first_text_date":null,"correction_applies":false,"versions":["2018-10-05"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4041-display-of-incorrect-authentication-factors-in-case-of/versions/2018-10-05","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4041-display-of-incorrect-authentication-factors-in-case-of/versions/2018-10-05/rev/06edf504aca4fae0","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4041-display-of-incorrect-authentication-factors-in-case-of/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4041-display-of-incorrect-authentication-factors-in-case-of/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 5 Oct 2018 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2018-10-05","question_submitted_on":"2018-06-28","locators":{"published_on":"EBA Q&A register entry 2018_4041, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4041, field 'Submission date'"}},"adoption":null}},"provenance":{"official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4041","check":{"result":"matched","checked_at":"2026-10-26","against":"the EBA publication"},"repo_path":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4041-display-of-incorrect-authentication-factors-in-case-of.md","body_sha256":"3b65e874dbff697aafe34b2c27af38edcd48e68d7c227e3bd82479859c819237"},"units":[],"markdown":"---\ntitle: \"EBA Q&A 2018_4041 — Q&A — Display of incorrect authentication factors in case [Final Q&A]\"\nshortTitle: \"EBA Q&A 2018_4041 — Q&A — Display of incorrect authentication factors in case [Final Q&A]\"\nanswer_id: EBA_QA_2018_4041\nstatus: \"Final Q&A\"\ntype: qa\ninstrument_type: qa\nauthority: EBA\nbinding: false\nbinding_character: non_binding\nlegal_status: in_force\nregulation: \"PSD2\"\npsd2_level3: true\nmica_level2: false\nlegal_basis: \"Article 97 PSD2\"\ndate: 5 October 2018\nsource_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4041\nlifecycle: \"Final Q&A\"\ntext_version: \"EBA Q&A register, 5 October 2018\"\nsource_url: \"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4041\"\ncheck_status: matched\nverified: true\nlast_checked: 2026-10-26\nchecked_against: \"the EBA publication\"\nsource:\n  prepared_by: \"EBA\"\n  published_by: \"EBA\"\n  published_in: \"EBA Single Rulebook Q&A tool\"\n  evidence:\n    prepared_by: \"Answer prepared by the EBA.\"\n    locator: \"EBA Q&A register entry 2018_4041, field 'Answer prepared by'\"\ndocument_type: \"qa_answer\"\nlegal_nature: \"not_legislation\"\naddressees: \"not stated in the document\"\ndates:\n  published_on: \"2018-10-05\"\n  question_submitted_on: \"2018-06-28\"\n  locators:\n    published_on: \"EBA Q&A register entry 2018_4041, field 'Final publishing date'\"\n    question_submitted_on: \"EBA Q&A register entry 2018_4041, field 'Submission date'\"\nlifecycle_label: \"Final Q&A\"\n---\n\n**Answer by the EBA, published in its Q&A tool · not legislation · published 5 Oct 2018 [Final Q&A]**\n\n*Final Q&A · EBA Q&A register, 5 October 2018 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4041)*\n\n| | |\n|---|---|\n| **Full title** | EBA Q&A 2018_4041 — Q&A — Display of incorrect authentication factors in case \\[Final Q&A\\] |\n| **Prepared by** | EBA |\n| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |\n| **Reference** | EBA_QA_2018_4041 |\n| **Document type** | Q&A |\n| **Legal nature** | Not legislation |\n| **Addressees** | Not stated in the document |\n| **Dates** | Published 5 October 2018; question submitted 28 June 2018 |\n| **Legal basis** | Article 97 PSD2 |\n| **Related instruments** | None recorded |\n| **Text on this page** | Word for word — the full text of the EBA publication |\n\n**Display of incorrect authentication factors in case of failed authentication attempts**\n\n### Question\n\nFor remote card transactions, may the user be informed of the incorrect authentication factor in case of a failed authentication attempt provided this does not increase the risk of fraud (e.g. for in-app transactions)?\n\n### Background\n\nArticle 4(3)(a) RTS requires that, if the authentication has failed to generate an authentication code, the identification of the incorrect authenticating factor must be impossible. This requirement can result in a poor user experience, as it was outlined in relation to Face-to-Face (F2F) payments during the EBA consultation on the draft RTS of August 2016. Some participants requested the EBA that \"the current model of transaction failure feedback for card transactions, i.e. “wrong PIN message” should be kept to avoid confusion for the payer and payee” (Question 5, page 49 of the Feedback Table annexed to the final draft RTS of February 2017). As a result of the consultation, F2F transactions have been excluded from the scope of this requirement. In our view, a pragmatic interpretation would be that not only F2F but also remote card transactions should be excluded from the scope of this requirement if this does not increase the risk of fraud. For example, with in-app transactions, the card is tokenized. The token is an ownership factor that is embedded in the device (or stored in the cloud). Thus, the token can never be an ‘incorrect’ authenticating factor (unless a technical error occurs). The incorrect factor is necessarily the other one (i.e., the fingerprint or the OTP). Informing the user of this does not increase the risk of fraud and would result in an improved customer experience.\n\n***\n\n### Answer\n\nIn accordance with Article 4(3)(a) of the Commission Delegated Regulation (EU) 2018/389 “Payment service providers shall ensure that the authentication by means of generating an authentication code includes each of the following measures: (a) where the authentication for remote access, remote electronic payments and any other actions through a remote channel which may imply a risk of payment fraud or other abuses has failed to generate an authentication code for the purposes of paragraph 1, it shall not be possible to identify which of the elements referred to in that paragraph was incorrect”.\n\nAccordingly, payment service providers should not provide any indication on which element was incorrect.\n\n***\n\n**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4041)\n\n## Related Level 1 articles\n\n- [Article 97 — Authentication](../../../articles/97.md)\n"}