Pagar con Tarjeta Ya No Será Igual: Token y Doble Autenticación Transforman la Seguridad de los Pagos

Starting April 1, 2026, Peru’s Superintendency of Banking, Insurance and AFP (SBS) began enforcing stronger authentication requirements for all card transactions, both in physical stores and online. The measure, which had been delayed from its original timeline, now mandates that every payment must be verified using at least two distinct factors of authentication. For in-person purchases, the new rules require the leverage of a card’s chip along with a PIN, fingerprint, or another biometric method approved by the card issuer. While some merchants already used this dual verification, it is now compulsory nationwide under SBS Resolution N.° 2286-2024. In digital environments, such as e-commerce platforms or mobile banking apps, the first factor involves standard card details—number, CVV, and expiration date. The second factor must be a dynamic authentication method, including a one-time code sent via SMS, biometric verification, or confirmation through the bank’s official app. The SBS emphasized that the rise in digital financial services has increased exposure to operational risks like fraud and data breaches. “Since July 1, the SBS requires enhanced authentication. In other words each transaction must be validated with at least two different factors,” the entity stated in its announcement. The regulation applies to all cards issued on or after July 1, 2025. For cards issued before that date, compliance will occur when they are renewed or replaced. The security framework extends to mobile wallets and banking apps, where each transaction must be accompanied by a unique token—generated specifically for that operation—alongside a second verification factor. The rule also covers contactless payments and transactions made through digital platforms, ensuring consistent security standards across all payment channels. No further details about implementation timelines or penalties were included in the original announcement.