2FA / MFA in Business Banking 2026 — Requirements and Security

PSD2 and the Strong Authentication Requirement

The PSD2 directive (Payment Services Directive 2) from 2018 requires strong customer authentication (SCA) for:

• Logging into online banking
• Approving payments above EUR 30
• Changes to account details

Strong authentication means at least 2 of 3 elements: knowledge (password), possession (phone/token), biometric characteristic (fingerprint, face).

2FA Methods Offered by Polish Banks

Most banks prefer the mobile app — it is the cheapest, fastest, and most secure option.

Specific Requirements for Businesses

Business accounts have additional security measures:

• Multi-user access — different individuals with different permissions (accountant, director, partner)
• Transaction limits — set separately for each user
• Combined authorisation — certain operations require confirmation from two persons
• Whitelists — predefined recipient accounts (transfers outside the list require additional verification)
• Hardware tokens — recommended for directors (RSA, YubiKey)

Cybersecurity — Most Common Threats

Businesses are targeted by attacks, including:

• Phishing — fake emails from "the bank" with a login link
• Vishing — phone call from a "bank employee" requesting an SMS code
• Malware on the computer — hijacking of the banking session
• SIM swap — theft of the SMS number, followed by account takeover
• Social engineering — fraudulently obtaining permission changes by impersonating a colleague

Safeguards: up-to-date software, a dedicated computer for banking, PIN/biometrics on your phone, and never relying on SMS as the sole 2FA method.

Frequently Asked Questions