<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-01-15","gaps":[],"covered":["EBA Q&A 2018_4135 — Q&A — SMS OTP and credit card as a two authentication factor [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4135-sms-otp-and-credit-card-as-a-two-authentication-factor","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4135-sms-otp-and-credit-card-as-a-two-authentication-factor","title":"EBA Q&A 2018_4135 — Q&A — SMS OTP and credit card as a two authentication factor [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4135-sms-otp-and-credit-card-as-a-two-authentication-factor","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-01","applies_from":null,"application":null,"version_label":"EBA Q&A register, 15 January 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4135","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"f7bbd01f10140a41","change_date":null,"nearest_versions":["2021-01-15"],"first_text_date":null,"correction_applies":false,"versions":["2021-01-15"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4135-sms-otp-and-credit-card-as-a-two-authentication-factor/versions/2021-01-15","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4135-sms-otp-and-credit-card-as-a-two-authentication-factor/versions/2021-01-15/rev/f7bbd01f10140a41","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4135-sms-otp-and-credit-card-as-a-two-authentication-factor/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4135-sms-otp-and-credit-card-as-a-two-authentication-factor/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 15 Jan 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-01-15","question_submitted_on":"2018-07-18","locators":{"published_on":"EBA Q&A register entry 2018_4135, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4135, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2018_4135 — Q&A — SMS OTP and credit card as a two authentication factor [Final Q&A]"
shortTitle: "EBA Q&A 2018_4135 — Q&A — SMS OTP and credit card as a two authentication factor [Final Q&A]"
answer_id: EBA_QA_2018_4135
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 97 PSD2"
date: 15 January 2021
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4135
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 15 January 2021"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4135"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2018_4135, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2021-01-15"
  question_submitted_on: "2018-07-18"
  locators:
    published_on: "EBA Q&A register entry 2018_4135, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2018_4135, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 15 Jan 2021 [Final Q&A]**

*Final Q&A · EBA Q&A register, 15 January 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4135)*

| | |
|---|---|
| **Full title** | EBA Q&A 2018_4135 — Q&A — SMS OTP and credit card as a two authentication factor \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2018_4135 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 15 January 2021; question submitted 18 July 2018 |
| **Legal basis** | Article 97 PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**SMS OTP and credit card as a two authentication factor**

### Question

Can we consider Credit card and One Time Password (OTP) SMS as a two authentication factor ?

### Background

The main authentication solution for online card payments deployed in France is based on sending a single-use confidential code by SMS to the bearer of the card, in addition to the payment card data entry (number, expiry date, cryptogram,even name and surname of the bearer). (Known as 3d-secure) for electronic payment.

EBA Opinion on the implementation of the RTS on SCA and CSC (Op-2018-04)- Article 36 : Given that knowledge is defined as ‘something only the user knows’, the card number with CVV and expiry date printed on the card cannot be considered a knowledge element.

Regulation (EU) 2018/389 – RTS on strong customer authentication and secure communication, Article 6 (Requirements of the elements categorised as knowledge) :

1.Payment service providers shall adopt measures to mitigate the risk that the elements of strong customer authentication categorised as knowledge are uncovered by, or disclosed to, unauthorised parties.

2.The use by the payer of those elements shall be subject to mitigation measures in order to prevent their disclosure to unauthorised parties.

***

### Answer

Paragraph 35 of the EBA Opinion on the Implementation of the RTS on SCA and CSC (EBA-Op-2018-04), stated that the card details and security code printed on the card would not constitute a knowledge element. In addition, while a card with a dynamic card security code may constitute a possession element, it would not constitute a knowledge element.

Table 2 of the EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06), notes that a Card with possession evidenced by either card details (printed on the card) or by a printed element (such as an OTP list) is not a compliant ‘possession’ element, for approaches currently observed.

In relation to the above, card details cannot be used as a valid factor in a two-factor Strong Customer Authentication (SCA) under Directive 2015/2366/EU (PSD2) and the Commission Delegated Regulation (EU) 2018/389. With regard to the SMS OTP, as clarified in Q&A 2018\_4039 a one-time password sent via SMS would constitute a possession element and should therefore comply with the requirements under Article 7 of the Delegated Regulation. This was also reflected in Table 2 of the EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06).

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4135)

## Related Level 1 articles

- [Article 97 — Authentication](../../../articles/97.md)