FIDO2 transaction signing with What-You-See-Is-What-You-Sign for PSD2 and PSD3
Crayonic Badge™ gives banks a phishing-resistant FIDO2 authenticator with its own trusted display. Customers and employees see the real payee and amount on the device, confirm on the device, and sign inside a certified secure element. Phishing, man-in-the-browser malware and remote-access fraud can no longer silently change a high-value payment.
Why passkeys alone are not enough for high-value payments
FIDO2 passkeys stop credential phishing, because they only work on the real banking domain. But a passkey on a phone or laptop signs whatever the infected browser or app asks it to sign. If malware or a remote-access scammer controls that screen, the user approves a payment they cannot see.
Hardware tokens with a trusted display have long been the answer for corporate and private banking, but most of them use one-time codes or challenge-response. Those can still be phished and relayed in real time. The Badge combines both approaches: FIDO2 origin binding stops phishing, and an independent display that malware cannot touch shows exactly what is being signed.
Phishing-resistant by design
FIDO2 / WebAuthn credentials are bound to the bank's domain. A look-alike site gets nothing it can replay.
What-You-See-Is-What-You-Sign
The Badge's e-ink screen shows the payee, IBAN and amount the bank received. The signature covers exactly that data and nothing else.
Malware cannot alter the approval
The display, PIN entry, fingerprint sensor and keys sit outside the PC or phone. A compromised browser, app or remote-access session cannot change what the user confirms.
Certified hardware root of trust
Keys are generated and kept in a Common Criteria EAL5+ secure element, the Badge is FIDO2 certified, and it is manufactured in the EU.
How a transaction is signed
- The customer starts a payment in online, mobile or corporate banking, on any PC or phone.
- The bank sends the transaction to the Badge over Bluetooth LE, NFC or USB. This happens as part of a FIDO2 authentication bound to the bank's domain.
- The Badge shows the real details (payee, account and amount) on its own display, independent of the possibly compromised screen.
- The customer confirms on the Badge itself with a PIN typed on its own touchscreen (never on the possibly compromised keyboard) or with the on-device fingerprint sensor.
- The secure element signs a cryptogram tied to that exact amount and payee. Any change in transit makes the signature invalid, so the bank rejects it.
Built for PSD2 today and PSD3 / PSR tomorrow
| Requirement | How Crayonic Badge helps |
|---|---|
| PSD2 strong customer authentication (two independent factors) | Possession (a key that cannot be extracted from the secure element) plus knowledge (a PIN entered on the Badge's own touchscreen) or inherence (the on-device fingerprint). The PIN never passes through the host PC or phone. |
| PSD2 dynamic linking (payer sees amount and payee, and the code is specific to them) | The amount and payee appear on the trusted display, and the signature is cryptographically bound to them. Changing either makes it invalid. |
| PSD3 / Payment Services Regulation: more liability for impersonation fraud | Under the incoming rules, banks carry more of the cost when fraudsters pose as the bank. Physically confirming the real payee on a trusted device sharply reduces "authorised" push-payment fraud. |
| PSR: SCA for customers without smartphones and accessible authentication | A standalone wearable gives elderly, low-digital-skill and smartphone-free customers a strong, easy authenticator with a large readable screen. |
| DORA and NIS2 for bank staff | The same Badge gives employees phishing-resistant login to Microsoft Entra ID, internal apps and back-office systems, with a full audit trail in Crayonic Device Manager. |
PSD3 and the Payment Services Regulation have been politically agreed at EU level. Final application dates depend on publication in the Official Journal.
Where banks use it
Corporate & treasury banking
Approve high-value and batch payments, with dual or multi-signatory control and every signature traceable to a person and device.
Private & premium banking
Give high-net-worth clients a premium hardware authenticator instead of SMS codes or app-only approval.
Replacing legacy tokens
Move from OTP, challenge-response and visual-cryptogram readers to FIDO2 standards, with WYSIWYS kept.
Qualified e-signatures
An optional embedded Thales IDPrime QSCD lets the Badge create eIDAS qualified electronic signatures for contracts and mandates.
Frequently asked questions
What is What-You-See-Is-What-You-Sign (WYSIWYS)?
WYSIWYS means the user confirms a transaction on a trusted display that malware on the PC or phone cannot control, and the signature covers exactly what was shown. Crayonic Badge combines WYSIWYS with FIDO2, so a single device protects against both phishing and malware.
Does a FIDO2 passkey on its own meet PSD2 dynamic linking?
A passkey proves who the user is and is phishing-resistant. But on a standard phone or laptop, the user only sees the transaction on a screen that malware could manipulate. Crayonic Badge adds an independent display and binds the signature to the amount and payee, which is what dynamic linking is meant to guarantee.
How does the Badge protect against banking malware and remote-access scams?
Approval happens on the Badge itself. If malware or a remote-access attacker swaps the payee or raises the amount, the user sees the real values on the Badge display and can refuse. A changed transaction also produces a signature the bank will reject.
Can the Badge replace our existing hardware OTP or transaction-signing tokens?
Yes. The Badge covers login and transaction signing with FIDO2 standards instead of proprietary OTP or challenge-response schemes, and adds a large display, on-device PIN entry, a fingerprint sensor and BLE/NFC/USB connectivity. Banks integrate through their FIDO server and Crayonic's transaction-signing integration.
Is Crayonic Badge ready for PSD3 and the Payment Services Regulation?
The Badge is designed around the main PSD3/PSR themes: strong customer authentication with dynamic linking, protection against impersonation and authorised push-payment fraud, and authentication options for customers without smartphones.
Where is the Badge made, and where are the keys stored?
The Badge is fully manufactured in the EU. Private keys and fingerprint templates never leave its Common Criteria EAL5+ certified secure element.
Pilot WYSIWYS transaction signing with your bank
We work with banks' security, digital channels and fraud teams to integrate Badge-based FIDO2 transaction signing into online, mobile and corporate banking.
Book a demoExplore Crayonic Badge