IMPORTANT: From January 1, 2021, the 3D-Secure authorization solution via SMS code for online payments with Vista Bank cards will be changed. In order to continue to make payments to merchants, under strict security, you may opt between: (1) install and activate the new Vista 3D Secure mobile application, completely free of charge and available on AppStore and GooglePlay – our recommendation OR (2) the solution with static password and unique code via SMS – which will be available in January.

Vista Bank provides you, free of charge, with the Vista 3D Secure authentication solution, a mobile application that allows you to conduct e-commerce transactions in strict security and with a simplified authentication process, with the help of biometric identification (digital fingerprint / facial recognition) or of other means that secure your mobile phone.

Since Vista Bank had already a 3D-Secure solution with dynamic correlation via SMS previously implemented, authentication through the Vista 3D Secure application will seem largely familiar to you. In short, the Vista 3D Secure mobile app will replace previous 3D Secure SMS authentication for customers who install their Vista 3D Secure app on an Android or iOS smartphone / tablet.

Please read carefully the Usage Terms and Conditions for 3D-Secure Service

Next, we will describe the steps for installing, registering, and using Vista 3D Secure.

A. Registration into the Vista 3D Secure mobile application

1. Download free of charge the Vista 3D Secure mobile app from the App Store (iOS) or Google Play Store (Android) on a smartphone or tablet.
2. Enter in the mobile application the valid mobile phone number registered with the Bank and the last 6 digits of the Vista Bank card number you want to enroll in the application. Important: Before registering, make sure that you have updated your personal data with Vista Bank, including the mobile phone number registered with the Bank.
3. Allow notifications from the app: during an e-commerce transaction, you will receive a “Push” notification via Vista 3D Secure to inform you of the need to confirm the payment.
4. You will receive on your mobile phone a unique, automatically generated SMS code. Enter this SMS code in the mobile application in the "SMS code" field.
5. Registration is complete! The above steps are performed only once, when registering into the application.

Note: If you have more than one card at Vista Bank, all of your other cards will be automatically enrolled in the application upon completion of registration according to the steps above.

The application allows you to authorize online payments made with the enrolled card (s), as well as view the History of recent transactions and their status (accepted, canceled, pending, expired).

From now on, your online card payments are easier and more secure! Vista Bank is making changes to online card payments to better protect you by increasing transaction security and to comply with the new legal framework in this field. Moreover, you benefit from a streamlined authentication process due to biometric identification methods (digital fingerprint / facial recognition).

For you, this means that when making online payments with the Vista Bank card in the European Economic Area (payments to online merchants) it is necessary to use the new Vista 3D Secure authentication solution, which complies with the Strong Customer Authentication (SCA) standard. More information about SCA and Vista 3D Secure compliance is available here.

To adopt the new solution, you have an adjustment period until the end of 2020, during which payments can also be made in the previous 3D Secure system. Given the advantages in terms of payment security, our recommendation is to adopt the new Vista 3D Secure solution as soon as possible and benefit immediately from the high level of security offered by the SCA standard.

What is the new legal framework that requires Strong Customer Authentication?

The changes in the field of online payments have a broader purpose and aim to protect consumers, reduce fraud and more strictly secure these transactions. The two regulations are:

• Law no. 209/2019 regarding the payment services and for the modification of some normative acts;
• Commission Delegated Regulation (EU) 2018/389 of 27 November 2017 supplementing Directive (EU) 2015/2366 of the European Parliament and of the Council with regard to regulatory technical standards for strong customer authentication and common and secure open standards of communication.

The new regulations require, among others, the use of Strong Customer Authentication (SCA) at online transactions.

What is Strong Customer Authentication (SCA)?

Strong Customer Authentication (SCA) in the case of online card payments (online payment at merchants / e-commerce payment) means that the identity of cardholders must be more strictly verified in the European Economic Area, using two of the three authentication methods presented below:

• Authentication methods based on knowledge (something only the customer knows): for example, password or PIN
• Authentication methods based on possession (something only the customer has): for example, a mobile device (smartphone, tablet) or other physical authentication device
• Authentication methods based on inherence (something the customer is): for example, digital fingerprint or facial recognition (biometric authentication).

Vista 3D Secure meets the new requirements, being a SCA compliant mobile application, certified by VISA International for the VISA Secure protocol and using:

• two authentication factors , the first based on possession (the application installed on a mobile device identified as being in the customer's possession at the enrollment stage, based on the phone number registered at the bank and the last 6 digits of the card, application that automatically generates a OTP unique code (one time passcode) for authorizing each transaction), and the second based on inherence (confirmation of the transaction by digital fingerprint / facial recognition) or knowledge (mobile phone security code).
• dynamic correlation protocol, a security measure by which you are informed on a second communications channel (in the Vista3D Secure application installed on your smartphone / tablet) about payment details (merchant name and payment amount) in the payment confirmation phase (to allow you to decide whether or not to authorize the respective online card payment)..

Note: The Bank does not process biometric data (digital fingerprint, facial recognition). This verification, part of the SCA, is performed strictly at the level of the user's mobile device (smartphone, tablet), the bank not having access to this data.

Out of scope SCA Transactions (exceptions to the application of the SCA):

• Transactions with virtual merchants outside the European Economic Area;
• Payments periodically initiated by merchants to the card account, based on a debit agreement previously expressed by the cardholder (eg. subscriptions).