Decoupled Authentication

Decoupled authentication is a way of verifying a customer in which the request starts in one place and the customer proves their identity somewhere else. A shopper may pay on a website or a cashier's terminal, or a third-party app may ask to access a bank account, and the customer then approves the action in their bank's mobile app or on another trusted device. The channel that starts the request and the channel that authenticates the customer are separated, or "decoupled".

The approach is used in open banking, where it is one of the recognised ways for a bank to apply strong customer authentication when a third party initiates a payment or data request, and in card payments under 3-D Secure 2, which includes a decoupled authentication option. It is often contrasted with redirection, where the customer is sent from the third party's screen to the bank's website or app and back again, and with embedded methods, where credentials are entered inside the third party's interface.

1. The customer begins an action, such as a purchase or an account connection, in a merchant's site, a third party's app or at a terminal.
2. The third party sends a request to the bank, identifying the customer, often by a username, phone number or account identifier.
3. The bank sends a notification to the customer's registered device, usually its banking app.
4. The customer opens the app, reviews the details and authenticates using a PIN, fingerprint or face recognition.
5. The bank tells the third party the result, either by a callback or by the third party checking the status, and the action proceeds or is refused.

In open banking standards, this pattern is often built on the OpenID Foundation's Client Initiated Backchannel Authentication (CIBA) specification, which defines how a client can request authentication without redirecting the user's browser. Several European API standards list decoupled as one of the supported SCA approaches alongside redirect and embedded.

In EMV 3-D Secure, decoupled authentication allows the issuer to authenticate the cardholder outside the 3DS challenge window, for example through a push notification to the banking app, with the result returned to the merchant later. It is useful where the cardholder cannot complete an on-screen challenge flow at the moment of purchase, such as in some call-centre payments, or where a merchant needs to authenticate a cardholder before a later merchant-initiated payment. The merchant indicates whether it can wait for a decoupled result, and the issuer decides whether to use the method. Decoupled authentication sits alongside frictionless authentication, where no customer action is needed, and the standard challenge.

• Better experience on some devices. Customers on smart TVs, in-car systems, kiosks or desktop computers do not need to type passwords; they approve on their phone.
• Security. Authentication happens in the bank's own app on a bound device, which supports the separation of factors required by SCA and limits exposure of credentials to third parties.
• Flexibility. The customer can approve shortly after the request, which suits telephone orders and scenarios where an immediate on-screen step is impractical.

Decoupled flows depend on the customer having the bank's app installed and notifications enabled. Delays can occur if the customer does not see the notification, leading to time-outs and abandoned payments. There is also a fraud risk: criminals who know a victim's identifier can trigger approval requests and then call the victim, pretending to be the bank, to persuade them to approve. Clear wording in the approval screen, showing the merchant, amount and purpose, helps customers recognise unexpected requests, and banks use risk-based authentication to spot unusual patterns.

The European Banking Authority's regulatory technical standards on SCA and secure communication do not mandate any single method, but they require that banks' interfaces do not create obstacles for third parties. Supervisors have indicated that mandatory redirection can be an obstacle in some circumstances, which has encouraged banks to offer decoupled and app-to-app options. In the United Kingdom, open banking standards include a decoupled model, and banks use it in particular for payment initiation where the customer is on a different device from the one holding the banking app. The method also features in work on delegated authentication and in the design of dedicated interfaces for third-party access.

Many banks support several approaches and choose the best for each situation. App-to-app redirection, where the third party opens the banking app directly on the same phone, offers a similar experience for mobile users. Decoupled authentication is most useful when the customer starts on one device and authenticates on another, or when the authentication must happen out of band. Combined with biometric authentication in the banking app, it can provide strong security with little friction.