Two-factor authentication and digital verification

Overview

Since EU rules (PSD2, and its Strong Customer Authentication requirement) took effect, most online card payments and banking actions in Spain and across the EU require a second verification step beyond just your card details or password.

Requirements

• Applies to most online card payments and account access within the EEA, and to any Spanish bank account

Step-by-step process

• When making an online card payment, expect a second verification step after entering your card details — commonly a code sent by SMS, or approval through your bank's app
• When logging into online banking from a new device, expect a similar additional verification step
• Approve the request promptly through the specified method (SMS code, app notification, or biometric confirmation)
• If you don't receive the verification prompt, check your registered phone number and app notification settings are current with your bank

Required documents

• A working mobile number and/or your bank's app installed, since these are how verification codes and prompts are delivered

Common mistakes

• Not updating your registered phone number after getting a new number, causing verification codes to fail to arrive
• Assuming a payment failed because of a technical error, when it actually failed because the required verification step wasn't completed

Practical tips

• Strong Customer Authentication combines at least two of: something you know (a password), something you have (your phone), and something you are (biometrics) — most Spanish banks use app-based approval or SMS codes as the practical version of this
• Keep your bank's app installed and notifications enabled, since app-based approval is often faster and more reliable than waiting for an SMS

How Tuchati can help

If verification steps aren't working and you can't complete a payment or login, Tuchati can help you troubleshoot with your bank.