Article 97.2 of the PSD2 Directive and Article 5 of the RTS on strong customer authentication and secure communication require payment service providers to apply SCA that includes elements which dynamically link the transaction to a specific amount and a specific payee for the initiation of electronic payment transactions. Article 13 of the RTS  allows payment service providers to not apply SCA where the payer initiates a payment transaction and the payee is included in a list of trusted beneficiaries previously created by the payer. SCA is to be applied where a payer creates or amends a list of trusted beneficiaries.

The requirement for applying  SCA aims at increasing security whilst reducing the risk of fraud. Applying SCA with dynamic linking to the payee and the amount when initiating a payment transaction aims at providing additional security beyond SCA without dynamic linking. However, the concept of trusted beneficiaries does not hinder an attacker adopting whitelisting with SCA (without any linking) for approving a new payee before initiating a fake payment. There appears to be no legitimate security rationale to limit a Payment Services User (PSU) beyond what an attacker is effectively limited to. The risk of circumvention by an attacker can consistently be mitigated e.g. by implementing, beyond current RTS requirements, SCA with dynamic linking to the payee whenever adding a new payee to the list of trusted beneficiaries.