{"id":3274,"date":"2026-10-29T11:49:15","date_gmt":"2026-10-29T01:49:15","guid":{"rendered":"https:\/\/www.gpayments.com\/blog\/?p=3274"},"modified":"2026-10-29T11:49:16","modified_gmt":"2026-10-29T01:49:16","slug":"e-payments-user-protection-guidelines-card-3ds","status":"publish","type":"post","link":"https:\/\/www.gpayments.com\/blog\/article\/e-payments-user-protection-guidelines-card-3ds\/","title":{"rendered":"How Singapore’s E-Payments User Protection Guidelines Apply to Card Authentication"},"content":{"rendered":"\n

The Monetary Authority of Singapore’s (MAS) E-Payments User Protection Guidelines set baseline protections for individuals and sole proprietors using e-payments. They are often read as a bank-account and e-wallet matter, and in some respects they are: the liability rules explicitly exclude cards. But several duties apply to card issuers, and one of them governs what a one-time passcode message must contain, which goes straight to the design of EMV 3D Secure (EMV 3DS) challenges.<\/p>\n

Which parts of the E-Payments User Protection Guidelines apply to cards<\/h2>\n

The current Guidelines<\/a>, effective 16 December 2024, apply duties to the \u2018responsible FI\u2019 for a protected account, which includes credit card, charge card and debit card issuers. But the text carves cards out of several sections:<\/p>\n\n\n\n\n\n\n\n\n
\n

Part of the Guidelines<\/strong><\/p>\n<\/td>\n

\n

Applies to card issuers?<\/strong><\/p>\n<\/td>\n

\n

Note<\/strong><\/p>\n<\/td>\n<\/tr>\n<\/thead>\n

\n

Duties of the responsible FI (Section 4)<\/p>\n<\/td>\n

\n

Partly<\/p>\n<\/td>\n

\n

Only paragraphs 4.2 to 4.6, 4.10 to 4.12 and 4.14 to 4.16 apply to cards<\/p>\n<\/td>\n<\/tr>\n

\n

Liability for unauthorised transactions (Section 5)<\/p>\n<\/td>\n

\n

No<\/p>\n<\/td>\n

\n

Card holders benefit from liability apportionment under the ABS Code of Practice for Banks – Credit Cards<\/p>\n<\/td>\n<\/tr>\n

\n

Erroneous transactions (Section 6)<\/p>\n<\/td>\n

\n

No<\/p>\n<\/td>\n

\n

Excludes card transactions<\/p>\n<\/td>\n<\/tr>\n

\n

Dispute timelines (paragraphs 7.5 and 7.6)<\/p>\n<\/td>\n

\n

Not where the issuer resolves the dispute under card scheme rules<\/p>\n<\/td>\n

\n

Paragraph 7.8<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

The separate Shared Responsibility Framework for phishing scams also excludes credit card, charge card and debit card accounts, as banks describe in their customer disclosures<\/a>.<\/p>\n

The duty that shapes 3DS challenge messages<\/h2>\n

Paragraph 4.16 is one of the duties that does apply to card issuers. It requires the information sent in the same message as an access code to let the user identify the payment: the account (such as the account number), the recipient by name or other credentials, the intended amount including currency, and a warning not to reveal the code to anyone. The Guidelines give one-time passwords sent by SMS, or equivalent push notifications through the issuer’s app, as examples.<\/p>\n

For a card issuer, that describes the SMS or push message used in an EMV 3DS challenge. An OTP that says only \u2018Your code is 123456\u2019 does not meet it. The message should name the merchant and the amount, identify the card, and warn the cardholder not to share the code. The Guidelines also expect users to read that content and check the recipient before completing the transaction (paragraph 3.8).<\/p>\n

Other card-issuer duties relevant to authentication<\/h2>\n