Commentary

Payment authentication standard spells change for vending and kiosks in Europe

The difficulty for vending and kiosk operators is that this new authentication standard introduces a layer of friction to transactions which for other companies can be dealt with relatively easily, but present particular problems for vending and kiosk businesses.

Image courtesy of iStock

May 11, 2020 by Paul Weston — Founder, KWP

(Editor's Note: The European Payment Institutions Federation in late April requested a delay to the implementation of Strong Customer Authentication of at least six months on account of the COVID-19 crisis. The letter to the European Banking Authority said many companies have had to redeploy resources to focus their efforts on business continuity. This blog was written prior to the recent EPIF letter.)

The vending and kiosk industries are facing a significant change due to new legislation which came into effect in Europe in March, and the businesses that take fast action to accommodate the new standard will be best placed to move forward without losing revenues.

The implementation of the European-wide Strong Customer Authentication became a legal requirement on March 14, 2020, and now anyone making a transaction with a debit or credit card is required in all cases to confirm their identity on the fifth transaction or after a cumulative payment value of £150 ($186.14) or £100 ($124.10) in a 24-hour period, whichever comes sooner. This applies no matter how the purchase is made, including through most types of vending machines or kiosks.

The SCA requires that at the time of transaction, the card holder provides additional details to prove the card is in the possession of the card holder as a measure to reduce the amount of card fraud across Europe. In the U.K. alone, card fraud amounted to £671.4 million ($833.168 million) in 2018, up 19% from the previous year according to data from UK Finance, and it is hoped that SCA will cut this figure considerably.

However, this new legislation introduces a layer of friction to transactions which for other companies can be dealt with relatively easily, but present particular problems for vending and kiosk operators. The key additional information that needs to be supplied when the card holder is challenged at the point of sale includes something they know, such as a PIN, something they have, which could be a phone or another piece of hardware, or something they are, which might be a biometric such as their fingerprint or facial recognition.

Potential loss of customers and revenue

If your payment machines do not allow the extra information to be provided, there is a chance you will see complaints to the sites where they are located because the buyer will lose confidence over time by experiencing declined transactions leading to an assumption the payment won't work. This will also likely result in sales drop because the machine will be considered to be out of order, and will create additional costs by having to send out an engineer.

For vending and kiosk operators, the challenge here is how to address solutions that cannot support SCA for the relatively low value of many products offered. All of these machines are affected by the new rules and those with contactless-only payment terminals will need to be upgraded to allow two-factor authentication.

Failure to do so means they will be non-compliant with the legislation, which could result in loss of revenue. Any additional friction in transactions could result in considerable losses.

Consider upgrading payment devices

We are already seeing significant moves towards from luxury brands who see the benefits of dealing with their customers through vending and kiosk experiences. There are a number of luxury brands exploring this as a means to cut out the middleman when it comes to marketing their goods directly to customers.

They are keen to operate in areas with high footfall such as airports without the need to provide staff or premises to sell their products. Vending reduces overall costs and allows them to control the entire process from the way the items are presented, through the experience of interacting with their brand and access the items once they have made their choice. There is no concern that a staff member might misunderstand the brand and consequently lose a sale for the designer or perfumier, for example.

However, each of these potential vendors also needs to use technology that allows them to comply with the SCA regulations to ensure no loss of sales. The drop-off of a sale with a small value is one thing, but if you are a high-value vendor, the potential to lose a customer because they cannot provide an additional element of SCA is unthinkable, and potentially very costly in more ways than one.

There are some merchant trade classes which are excluded from the new rules, including travel, parking, electric vehicle charging and charitable donations. All non-excluded sectors must comply and should take action.

So what should businesses in affected sectors do to ensure they don't fall foul of the rules or lose sales through attrition because people simply assume their card isn't working? There are solutions in the market that allow for the simple changing and upgrading of the payment points from just contactless to ones that prompt for additional information to be compliant with SCA.

It is a question of just making the decision and moving forward once you know the overall cost to the business to change the vending machines and kiosks you run. With loss of customers and revenue a real risk now that SCA has come into play, a business really can't afford not to upgrade.