In May 2019, LuxTrust customers will have to define one image that will become their “secret image” when using LuxTrust token or chip-based products (SmartCard, Signing Stick) or Luxembourg Identity Card. This image will be defined the first time they use their LuxTrust identity when connecting on partner sites such as LuxTrust, online banking, MyGuichet.lu or MultiLine and always be presented when customers have to enter their One Time Password (OTP) or their PIN-Code. The details of the operation will be embedded in this image, which is only known by the user in question.

Why this new step?

This new step is necessary to comply with the European “Payment Services Directive 2", also known as “PSD2”. In order to better protect consumers who make payments online, the latter requires, among other things, the implementation of strong authentication and what is known as “contextualization of the transaction”. In other words, the consumer must be able to make payments securely and be able to validate any transaction by having all the information in his or her possession (such as the IBAN account, the amount and the recipient for a payment). Good news, with the secret image, all LuxTrust devices fulfill these requirements!

By adding an image that the customer has chosen and that only he knows, LuxTrust adds an additional security. Thus if the image the customer sees is not the chosen one, the customer should cancel his transaction and contact LuxTrust. The predefined image can be changed at any time in the MyLuxtrust personal space. Please note consumers who use their Token with 3D Secure Service when shopping online won’t see their secret image yet. This step will be added later this year.

Although the MyGuichet.lu portal was not targeted by the PSD2 directive, the Ministry for Digitalisation took the decision to adopt the secret image to add an extra layer of security to its MyGuichet.lu platform and enable citizens to have a consistent experience when using LuxTrust.

For more information, users can visit www.luxtrust.lu.