From May 2019, LuxTrust customers will be required to select a "secret image" when connecting with LuxTrust products.

In order to enhance data security, LuxTrust is introducing a “secret image” requirement for customers wishing to use a LuxTrust token or chip-based products or Luxembourg Identity Card. This image will be defined the first time they use their LuxTrust identity when connecting on partner sites such as LuxTrust, online banking, MyGuichet.lu or MultiLine and will always be presented when customers need to enter their One Time Password (OTP) or their PIN-Code. The details of the operation will be embedded in this image, which is only known by the user in question.

This new step is considered necessary to comply with the European “Payment Services Directive 2", also known as “PSD2”. In order to better protect consumers who make online payments, the latter requires, among other things, the implementation of strong authentication and what is known as “contextualisation of the transaction”. In other words, the consumer must be able to make payments securely and be able to validate any transaction by having all the information in his or her possession (such as the IBAN account, amount and recipient). With the secret image, all LuxTrust devices are set to fulfil these requirements.

By adding an image that the customer has chosen and that only they know, LuxTrust will add additional security. If the image the customer sees is not the chosen one, the customer should cancel their transaction and contact LuxTrust. The predefined image can be changed at any time in the MyLuxtrust personal space. Consumers who use their Token with 3D Secure Service when shopping online will not yet see their secret image; this step will be added later this year.

Whilst the PSD2 did not target the MyGuichet.lu portal, the Luxembourg Ministry for Digitalisation nevertheless took the decision to adopt the secret image to add an extra layer of security to its platform and enable citizens to have a consistent experience when using LuxTrust.

For more information, users can visit www.luxtrust.lu.