Strong Customer Authentication: What It Means in Practice

Until a few years ago, paying online still felt like a small act of courage. Today, we do it for lunches, tickets, top-ups, last-minute gifts, without even thinking about it. The problem is that habit has dulled our awareness, and the average scam exploits precisely this: quick transactions, distraction, and trust in a familiar logo that might secretly be fake.

New European regulations, progressively introduced over the last few years, have significantly raised the bar. Today, any online payment above a certain threshold must go through strong customer authentication, meaning at least two different factors. The practical consequence is that the classic "copy-paste" card theft is far less effective than before, and scammers have shifted towards social engineering.

A detail almost no one mentions is that online payments in euros between European parties are now almost all instant, and the cost to the bank is close to zero. When someone asks you for a small extra fee because "instant payment costs," they are telling you something that hasn't been true for years. It's not dramatic, but it's a good sign to understand who you're dealing with.

A simple but powerful habit is to keep the minimum possible funds on the card you use for online purchases. Use a dedicated pre-paid card, top it up with exactly the amount you need. Even if someone manages to steal its data, the maximum damage is already limited from the outset. Small friction, great peace of mind.

The first thing I look at when paying online is the method the seller asks me to use. If someone insists on an immediate bank transfer to a personal account, or worse, a postal top-up, ten out of ten times something is off. It's no longer even a matter of trust: it's that those tools, by their very design, don't provide a real mechanism for reconsideration. Once the money is gone, you're chasing it.

If a site asks you to save your card "for convenience," think twice. It's not necessarily a bad idea, but it means you're delegating that responsibility to whoever is in front of you. When in doubt, I always prefer to enter the data manually each time: I lose ten seconds and avoid the worry of understanding how and where it will be stored.

What truly matters in this market isn't a single lucky deal. What matters are the rules you set for yourself, which remain valid even when you're in a hurry, even when you're excited to have found the right listing. Discipline, for once, trumps opportunity.