Originally Posted by
lavajava
Well, this is typical BA.
This regulation was released in 2018, yes, nearly 4 years ago. Mind you, looks this they updated the code for one page since then. The website is a mess, I wonder what they are paying Tata for.
As a data point I made a holiday booking using a BA amex on Sunday that if I remember correctly did indeed require secondary authorisation.
Although the PSD2 standard was released in 2018, the first few years were needed for the backend stuff (card brands (Visa, MC, Amex, Discover), card issuing banks (Barclays, NatWest, Starling, etc), and more latterly the payment services providers (Worldpay. sagepay, etc) to all get their house in order. The real reality is that some early mover merchants with backend services that were ahead of the curve were probably able to start to use 3DS v2 in late 2020. Because of all of the above, many merchants were only really able to tackle this in 2021, and there's a good long list of stragglers.
For those who have off the shelf shopping cart and payment services the transition has probably been a non-issue or just a tickbox somewhere, it's the bigger retailers with custom integrations and legacy infrastructure where the pain is really being felt.