Apple Pay

Strong customer authentication

European banking regulations strictly mandate two-factor authentication for electronic e-commerce payments to mitigate consumer fraud. Device-level biometric authentication techniques, such as scanning a fingerprint or mapping facial geometry, simultaneously satisfy the possession and inherence factors required under the current Strong Customer Authentication framework.

By relying on hardware-based verification routines, merchants bypass the need for external SMS codes or app-based authentication protocols.

The issuing bank treats the embedded cryptogram as a fully compliant challenge response, preserving the frictionless consumer checkout while strictly adhering to regulatory scheme rules for identity verification.

Tokenisation liability and compliance

Storing primary account numbers directly on internal merchant servers creates a significant compliance burden under the Payment Card Industry Data Security Standard.

Network tokenisation replaces these sensitive details with surrogate values, ensuring the actual primary account number never touches the merchant database during the payment lifecycle.

This encrypted architecture drastically reduces the regulatory compliance scope for the merchant while securing a liability shift from the business to the card issuer.

When an order undergoes successful hardware authentication, network scheme rules generally protect the merchant against fraud-related chargebacks originating from that specific transaction.