--- title: "EBA Q&A 2018_4141 — Q&A — Authentication code [Final Q&A]" shortTitle: "EBA Q&A 2018_4141 — Q&A — Authentication code [Final Q&A]" answer_id: EBA_QA_2018_4141 status: "Final Q&A" type: qa instrument_type: qa authority: EBA binding: false binding_character: non_binding legal_status: in_force regulation: "PSD2" psd2_level3: true mica_level2: false legal_basis: "Article 97(1) PSD2" date: 24 May 2019 source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4141 lifecycle: "Final Q&A" text_version: "EBA Q&A register, 24 May 2019" source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4141" check_status: matched verified: true last_checked: 2026-10-26 checked_against: "the EBA publication" source: prepared_by: "EBA" published_by: "EBA" published_in: "EBA Single Rulebook Q&A tool" evidence: prepared_by: "Answer prepared by the EBA." locator: "EBA Q&A register entry 2018_4141, field 'Answer prepared by'" document_type: "qa_answer" legal_nature: "not_legislation" addressees: "not stated in the document" dates: published_on: "2019-05-24" question_submitted_on: "2018-07-18" locators: published_on: "EBA Q&A register entry 2018_4141, field 'Final publishing date'" question_submitted_on: "EBA Q&A register entry 2018_4141, field 'Submission date'" lifecycle_label: "Final Q&A" --- **Answer by the EBA, published in its Q&A tool · not legislation · published 24 May 2019 [Final Q&A]** *Final Q&A · EBA Q&A register, 24 May 2019 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4141)* | | | |---|---| | **Full title** | EBA Q&A 2018_4141 — Q&A — Authentication code \[Final Q&A\] | | **Prepared by** | EBA | | **Published by** | EBA, in the EBA Single Rulebook Q&A tool | | **Reference** | EBA_QA_2018_4141 | | **Document type** | Q&A | | **Legal nature** | Not legislation | | **Addressees** | Not stated in the document | | **Dates** | Published 24 May 2019; question submitted 18 July 2018 | | **Legal basis** | Article 97(1) PSD2 | | **Related instruments** | None recorded | | **Text on this page** | Word for word — the full text of the EBA publication | **Authentication code** ### Question Is it allowed to use the (authenticated) session that a user has (after logging in (with or without SCA)) as 1 of the authentication factor when performing SCA for a payment transaction? For example: A customer logs in with its username & password (knowledge) + SMS One Time Password (possession). Once in his online banking environment he looks at his statements. Within that same session (that ends after 5 minutes inactivity) he makes a payment. The question is if for authenticating the payment it is required to perform SCA again or if the authenticated session (based on the previous authentication) and a second SMS One Time Password (possession) that dynamically links the payment would suffice. ### Background No additional security risk mitigation seen as a result of 're-asking' the first factor within a matter of minutes within the same session; however it will negatively influence the customer experience *** ### Answer Article 4 of the Commission Delegated Regulation 2018/389 states that “where payment service providers apply strong customer authentication”, “the authentication shall be based on two or more elements which are categorised as knowledge, possession and inherence and shall result in the generation of an authentication code”. In accordance with paragraph 36 of the EBA Opinion on the implementation of the RTS on Strong customer authentication (SCA) and common and secure communication (CSC) published in June 2018, “SCA has to be applied to access to payment account information and to every payment initiation, including within a session in which SCA was performed to access the account data, unless an exemption under the RTS applies”. The Commission Delegated Regulation does not prescribe a time limit for the provision of the two authentication elements necessary for SCA while within a session. When initiating a payment, SCA may therefore be performed when one of the elements used at the time the customer accessed its payment account online (including via a mobile app) is reused in compliance with Article 4, and the other element of SCA is carried out at the time the payment is initiated, provided that the dynamic linking element required under Article 97(2) PSD2 and detailed under Article 5 of the Delegated Regulation is present and linked to that latter element. *** **Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4141) ## Related Level 1 articles - [Article 97 — Authentication](../../../articles/97.md)