{"id":4846,"date":"2024-11-27T12:09:39","date_gmt":"2024-11-27T11:09:39","guid":{"rendered":"https:\/\/djp-a9vm.1wp.site\/?p=4846"},"modified":"2026-10-19T19:05:12","modified_gmt":"2026-10-19T17:05:12","slug":"payment-transaction-security-recommendations","status":"publish","type":"post","link":"https:\/\/djp.pl\/en\/payment-transaction-security-recommendations\/","title":{"rendered":"Payment transaction security \u2014 recommendations"},"content":{"rendered":"

In our previous article, we discussed the \u201cCybersecure wallet\u201d report. Online transaction security is a challenge not only for commerce and finance but also for institutions responsible for market safety and proper functioning.<\/p>\n

In October, the President of UOKiK published recommendations for payment service providers to improve cashless payment security and reduce fraudulent transactions. The working group included representatives of the Polish Financial Supervision Authority and financial sector experts. Based on consumer complaints to UOKiK, they categorised the most common fraudulent transactions and formulated non-binding recommendations to reduce the risk.<\/p>\n

Some recommendations are already widely applied, such as monitoring customers\u2019 transactions, selecting appropriate anti-fraud safeguards, and additional identity checks by calling customers about unusual transactions. Some proposed measures are new, however, and implementation will require new procedures and technical solutions.<\/p>\n

Below we discuss selected recommendations:<\/p>\n

Recommendations to improve payment security<\/h2>\n
    \n
  1. A cooling period<\/strong>: a delay between the customer issuing an instruction in the system and the provider executing it. This is particularly recommended for activity unusual for that customer, such as a substantial increase in transaction limits, changes to details including communication methods, or enabling additional mobile app account functions. The cooling period may be omitted if identity is verified through a different communication channel from the one used for the instruction, or the customer previously notified an intention to carry out the transaction.<\/li>\n
  2. Transaction limits<\/strong>: customers should be able to set limits at any level they choose, but the provider should inform consumers of optimal limits and encourage them to lower their own. An increase should generally apply for a specified period, after which the previous limit is restored automatically.<\/li>\n
  3. Restricting certain functions, including consumer credit, in mobile apps or customer accounts<\/strong>: providers should not enable consumers by default to take on financial obligations through an app or online account (\u201cone-click credit\u201d). This function should always be available at the consumer\u2019s request.<\/li>\n
  4. Blocking app login while the device has an active remote session with any other device<\/strong>: on detecting this situation, the provider should block access to the mobile app or online customer account, particularly if the device\u2019s IP address indicates a location outside Poland. The consumer should also be informed that the login attempt was detected and blocked.<\/li>\n
  5. Authenticating the provider\u2019s employee<\/strong>: the provider should require employees to authenticate themselves on every customer contact, for example by generating a push notification in the consumer\u2019s app and mentioning it during the call, or by another agreed method such as a previously agreed PIN.<\/li>\n
  6. Enabling customers to report unauthorised or fraudulent payments quickly<\/strong>: providers should establish a dedicated free helpline and chat in the app and on the website solely for these transactions. The helpline number should be displayed so it can be found intuitively and quickly. Customers should receive service without excessive waiting for connection or acceptance of a report. The helpline should allow conversation with a provider employee; if AI or a chatbot handles it, the customer should be told at the start.<\/li>\n
  7. A panic\/emergency button<\/strong>: providers should let consumers immediately block all transactions in the mobile app and online account. Transactions should remain blocked until unblocked at a branch or for a predetermined time. The block should affect transactions alone, without blocking communication channels available in the app or online account.<\/li>\n
  8. SCA for CNP transactions<\/strong>: providers should aim to require strong customer authentication (SCA) whenever a consumer initiates a card-not-present (CNP) transaction without physically using the card.<\/li>\n
  9. Authentication details visible on payment cards<\/strong>: providers should aim to ensure that authentication details enabling a payment are not visible on the card, particularly CVC\/CVV numbers.<\/li>\n
  10. Single-use virtual cards<\/strong>: providers should offer virtual cards generated for a particular transaction. This minimises risk if authentication details leak from the payee.<\/li>\n
  11. Strong authentication<\/strong>: providers should offer strong authentication methods resistant to interception of sensitive information by unauthorised persons.<\/li>\n
  12. AI or individual biometric systems<\/strong>: providers should work towards systems detecting unusual activity at authentication in online accounts or mobile apps. Behavioural data systems should identify the types of data verified, obtain consumers\u2019 express consent to processing, clearly restrict the purposes for which collected data is used and expressly identify third parties processing it.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

    In our previous article, we discussed the \u201cCybersecure wallet\u201d report. Online transaction security is a challenge not only for commerce and finance but also for institutions responsible for market safety and proper functioning.<\/p>\n","protected":false},"author":17,"featured_media":1931,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_seopress_robots_follow":"","_seopress_robots_imageindex":"","_seopress_robots_snippet":"","_seopress_robots_primary_cat":"294","_seopress_robots_breadcrumbs":"","_seopress_robots_freeze_modified_date":"","_seopress_robots_custom_modified_date":"","_seopress_robots_canonical":"","_seopress_social_fb_title":"","_seopress_social_fb_desc":"","_seopress_social_fb_img":"","_seopress_social_fb_img_attachment_id":0,"_seopress_social_fb_img_width":0,"_seopress_social_fb_img_height":0,"_seopress_social_twitter_title":"","_seopress_social_twitter_desc":"","_seopress_social_twitter_img":"","_seopress_social_twitter_img_attachment_id":0,"_seopress_social_twitter_img_width":0,"_seopress_social_twitter_img_height":0,"_seopress_redirections_value":"","_seopress_redirections_enabled":"","_seopress_redirections_enabled_regex":"","_seopress_redirections_logged_status":"","_seopress_redirections_param":"","_seopress_redirections_type":0,"_seopress_analysis_target_kw":"","_seopress_news_disabled":"","_seopress_video_disabled":"","_seopress_video":[],"_seopress_pro_schemas_manual":[],"_seopress_pro_rich_snippets_disable_all":"","_seopress_pro_rich_snippets_disable":[],"_seopress_pro_schemas":[],"iawp_total_views":0,"_djp_featured_image_mode":"full","footnotes":""},"categories":[{"term_id":294,"name":"Articles","slug":"articles-en","term_group":0,"term_taxonomy_id":294,"taxonomy":"category","description":"","parent":0,"count":100,"filter":"raw","cat_ID":294,"category_count":100,"category_description":"","cat_name":"Articles","category_nicename":"articles-en","category_parent":0},{"term_id":301,"name":"Banking","slug":"banking-en","term_group":0,"term_taxonomy_id":301,"taxonomy":"category","description":"","parent":0,"count":38,"filter":"raw","cat_ID":301,"category_count":38,"category_description":"","cat_name":"Banking","category_nicename":"banking-en","category_parent":0},{"term_id":291,"name":"General","slug":"general-en","term_group":0,"term_taxonomy_id":291,"taxonomy":"category","description":"","parent":0,"count":153,"filter":"raw","cat_ID":291,"category_count":153,"category_description":"","cat_name":"General","category_nicename":"general-en","category_parent":0},{"term_id":299,"name":"Technology","slug":"technology-en","term_group":0,"term_taxonomy_id":299,"taxonomy":"category","description":"","parent":0,"count":17,"filter":"raw","cat_ID":299,"category_count":17,"category_description":"","cat_name":"Technology","category_nicename":"technology-en","category_parent":0}],"tags":[],"djp_center":[],"coauthors":[],"class_list":["post-4846","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-articles-en","category-banking-en","category-general-en","category-technology-en"],"acf":{"djp_promote_now":false,"djp_promotion_days":7},"images":{"thumbnail":"https:\/\/djp.pl\/wp-content\/uploads\/2024\/11\/Zdjecie_artykul-Wytyczne-PUOKiK-scaled-1-150x150.jpg","medium":"https:\/\/djp.pl\/wp-content\/uploads\/2024\/11\/Zdjecie_artykul-Wytyczne-PUOKiK-scaled-1-200x300.jpg","medium_large":"https:\/\/djp.pl\/wp-content\/uploads\/2024\/11\/Zdjecie_artykul-Wytyczne-PUOKiK-scaled-1-768x1152.jpg","large":"https:\/\/djp.pl\/wp-content\/uploads\/2024\/11\/Zdjecie_artykul-Wytyczne-PUOKiK-scaled-1-683x1024.jpg","full":"https:\/\/djp.pl\/wp-content\/uploads\/2024\/11\/Zdjecie_artykul-Wytyczne-PUOKiK-scaled-1-djp-web.webp"},"_links":{"self":[{"href":"https:\/\/djp.pl\/en\/wp-json\/wp\/v2\/posts\/4846","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/djp.pl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/djp.pl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/djp.pl\/en\/wp-json\/wp\/v2\/users\/17"}],"replies":[{"embeddable":true,"href":"https:\/\/djp.pl\/en\/wp-json\/wp\/v2\/comments?post=4846"}],"version-history":[{"count":2,"href":"https:\/\/djp.pl\/en\/wp-json\/wp\/v2\/posts\/4846\/revisions"}],"predecessor-version":[{"id":5494,"href":"https:\/\/djp.pl\/en\/wp-json\/wp\/v2\/posts\/4846\/revisions\/5494"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/djp.pl\/en\/wp-json\/wp\/v2\/media\/1931"}],"wp:attachment":[{"href":"https:\/\/djp.pl\/en\/wp-json\/wp\/v2\/media?parent=4846"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/djp.pl\/en\/wp-json\/wp\/v2\/categories?post=4846"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/djp.pl\/en\/wp-json\/wp\/v2\/tags?post=4846"},{"taxonomy":"djp_center","embeddable":true,"href":"https:\/\/djp.pl\/en\/wp-json\/wp\/v2\/djp_center?post=4846"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/djp.pl\/en\/wp-json\/wp\/v2\/coauthors?post=4846"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}