Online Payments Security

It’s important to always remain vigilant and protect yourself from payment fraud when making any kind of online payments.

If your card is declined

• Take a screenshot of the error message or make a note of it.
• Immediately contact your Issuing Bank to find out the reason. This is the bank that owns the card that you are using to make this transaction.
• Whilst speaking to your Issuing Bank please have to hand your card details and the name of the website you are trying to pay through.

Verified by VISA / Mastercard SecureCode and 3-D Secure requests

When you make a card payment online, after entering your card details you are presented with a Verified by VISA page, or if using a Mastercard, you will be taken to a MasterCard SecureCode page. These are the schemes’ proprietary 3 Domain Secure (3-DS or 3-D Secure) services.

3-DS provides an additional layer of security for eCommerce transactions prior to authorisation and fulfils the requirements of the latest Payment Service Directive (PSD2) through Strong Customer Authentication (SCA). The three parties involved in the 3-DS process are:

• The merchant; in this case the merchant is SchoolMoney
• The card issuer; in most cases this is a bank or building society
• VISA or Mastercard

When necessary, the consumer will be asked to validate that the transaction is being initiated by the rightful owner of the account. 3-DS does this by supporting the requirements of the SCA, where two of the three requirements below must be met:

• Something only the customer has (e.g. a mobile device)
• Something only the customer knows (e.g. a password)
• Something only the customer is (e.g. a fingerprint)

Through using EMV® 3-D Secure (formerly known as 3DS 2.0) to authenticate Card-Not-Present transactions. PSD2 SCA can be fulfilled.

You should never be asked for an ATM PIN.

ATM PIN requests

3-DS will never ask for your card’s ATM PIN. If you are prompted to enter an ATM PIN or anything other than a username or password, DO NOT enter anything. This will ensure that your money and bank details remain safe.

• Take a screenshot of the page before closing it and delete the entry from your browser history.
• Log out of the SchoolMoney system and close your browser completely.
• Please choose another time and possibly another device to make the payment.

Following the above steps will ensure that your bank details and money remain safe. Next, contact your Issuing Bank to report what happened.

An ATM PIN request could be linked to a phishing attack and likely occurred through clicking on an unsecure or malicious link, pop-up or email unrelated to SchoolMoney on your device recently.

Phishing attacks are not caused by using SchoolMoney and are most likely standalone incidents targeting your device. However, this does not mean your device is at risk. This situation is rare and unfortunately is not something that can be resolved by SchoolMoney or their partners.

Devices at risk include mobile phones, tablets, laptops and computers.

Do you have school payment questions?

If you’re a SchoolMoney customer (i.e. you work in a school or trust), please check our Support Hub or reach out to our support team if you need any assistance.

Please note that we are unable to offer support directly to parents and guardians. In this case, please reach out to your school for assistance and they will be able to get in touch with us if needed.

More information about 3-DS can be found via the following links:

https://www.visa.co.uk/products/visa-secure.html
https://www.mastercard.co.uk/en-gb/personal/safety-security/identity-check.html