<!-- headlesslaw {"release":{"id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","published":"2026-11-01T16:41:30Z","pinned":false},"limits":{"coverage":{"history":"current_only","held_since":"2021-01-15","gaps":[],"covered":["EBA Q&A 2018_4315 — Q&A — Strong Authentication [Final Q&A] L3"],"not_covered":["national guidance","court decisions"]},"freshness":{"release_id":"a4f2a0495fe55b47323883f82977a9b34ab66171ec9623e39925d3a7045b6c81","release_published":"2026-11-01T16:41:30Z","checked_at":"2026-10-26","checked_against":"the EBA publication"},"truncation":null,"failures":[],"incomplete":[]},"page":{"path":"/psd2/level-3/q-and-a/eba/eba-qa-2018-4315-strong-authentication","url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4315-strong-authentication","title":"EBA Q&A 2018_4315 — Q&A — Strong Authentication [Final Q&A]","family":"l3","work_id":"spaces/psd2/level-3/q-and-a/eba/eba-qa-2018-4315-strong-authentication","status":"final q&a","force_status":null,"date_state":"current","requested_date":null,"as_of":"2026-11-02","applies_from":null,"application":null,"version_label":"EBA Q&A register, 15 January 2021","check":{"against":"the EBA publication","on":"2026-10-26"},"check_result":"matched","official_url":"https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4315","valid_from":"0001-01-01","valid_until":null,"revision":1,"content_id":"42ed72734a787da1","change_date":null,"nearest_versions":["2021-01-15"],"first_text_date":null,"correction_applies":false,"versions":["2021-01-15"],"version_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4315-strong-authentication/versions/2021-01-15","revision_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4315-strong-authentication/versions/2021-01-15/rev/42ed72734a787da1","versions_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4315-strong-authentication/versions","relations_url":"https://www.headlesslaw.com/psd2/level-3/q-and-a/eba/eba-qa-2018-4315-strong-authentication/relations","source_line":"Answer by the EBA, published in its Q&A tool · not legislation · published 15 Jan 2021 [Final Q&A]","attribution":{"prepared_by":"EBA","published_by":"EBA","published_in":"EBA Single Rulebook Q&A tool","document_type":"qa_answer","legal_nature":"not_legislation","addressees":"not stated in the document","dates":{"published_on":"2021-01-15","question_submitted_on":"2018-10-08","locators":{"published_on":"EBA Q&A register entry 2018_4315, field 'Final publishing date'","question_submitted_on":"EBA Q&A register entry 2018_4315, field 'Submission date'"}},"adoption":null}}} -->
---
title: "EBA Q&A 2018_4315 — Q&A — Strong Authentication [Final Q&A]"
shortTitle: "EBA Q&A 2018_4315 — Q&A — Strong Authentication [Final Q&A]"
answer_id: EBA_QA_2018_4315
status: "Final Q&A"
type: qa
instrument_type: qa
authority: EBA
binding: false
binding_character: non_binding
legal_status: in_force
regulation: "PSD2"
psd2_level3: true
mica_level2: false
legal_basis: "Article 97 PSD2"
date: 15 January 2021
source_link: https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4315
lifecycle: "Final Q&A"
text_version: "EBA Q&A register, 15 January 2021"
source_url: "https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4315"
check_status: matched
verified: true
last_checked: 2026-10-26
checked_against: "the EBA publication"
source:
  prepared_by: "EBA"
  published_by: "EBA"
  published_in: "EBA Single Rulebook Q&A tool"
  evidence:
    prepared_by: "Answer prepared by the EBA."
    locator: "EBA Q&A register entry 2018_4315, field 'Answer prepared by'"
document_type: "qa_answer"
legal_nature: "not_legislation"
addressees: "not stated in the document"
dates:
  published_on: "2021-01-15"
  question_submitted_on: "2018-10-08"
  locators:
    published_on: "EBA Q&A register entry 2018_4315, field 'Final publishing date'"
    question_submitted_on: "EBA Q&A register entry 2018_4315, field 'Submission date'"
lifecycle_label: "Final Q&A"
---

**Answer by the EBA, published in its Q&A tool · not legislation · published 15 Jan 2021 [Final Q&A]**

*Final Q&A · EBA Q&A register, 15 January 2021 · Checked against the EBA publication on 26 Oct 2026 · [Official source](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4315)*

| | |
|---|---|
| **Full title** | EBA Q&A 2018_4315 — Q&A — Strong Authentication \[Final Q&A\] |
| **Prepared by** | EBA |
| **Published by** | EBA, in the EBA Single Rulebook Q&A tool |
| **Reference** | EBA_QA_2018_4315 |
| **Document type** | Q&A |
| **Legal nature** | Not legislation |
| **Addressees** | Not stated in the document |
| **Dates** | Published 15 January 2021; question submitted 8 October 2018 |
| **Legal basis** | Article 97 PSD2 |
| **Related instruments** | None recorded |
| **Text on this page** | Word for word — the full text of the EBA publication |

**Strong Authentication**

### Question

Is one time passcode (OTP) Mail considered as a "Strong Customer Authentication" under Regulation (EU) 2018/389 – RTS on strong customer authentication and secure communication?

### Background

Authentication by OTP mail reunites 2 authentication factors :

1. The one-time password received by mail, enrolled by the payer's bank

2. The password to access mails, only known by the payer.

OTP mail is convenient for expatriates that can not have access to the SMS. It aims at replacing authentication by birthday date which is not a valid authentication method regarding the RTS.

***

### Answer

Article 4 (30) of Directive 2015/2366/EU (PSD2) defines possession as ‘something only the user possesses’.

Paragraph 26 of the EBA Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06), clarified that approaches relying on mobile apps, web browsers or the exchange of (public and private) keys may also be evidence of possession, provided that they include a device-binding process that ensures a unique connection between the payment service user’s app, browser or key and the device.

This means that apps or web browsers (i) where the email with the OTP is received by the payment service users and (ii) which have a unique connection with the device, could evidence possession and thus be considered as a valid factor in a two-factor strong customer authentication under PSD2 and the Commission Delegated Regulation (EU) 2018/389. This would, however, require the email address where the OTP is sent to, to be accessible only via a registered device.

Finally, it is for the payment service provider to ensure the unique connection between the device and the payment service user’s app or browser.

***

**Source:** [EBA original document](https://www.eba.europa.eu/single-rule-book-qa/qna/view/publicId/2018_4315)

## Related Level 1 articles

- [Article 97 — Authentication](../../../articles/97.md)