Secure card payments
Strong customer authentication
Secure online payments
Enhanced authentication for online payments with Stopanska Banka payment cards
As of March 1, 2026, the legislation that introduced enhanced authentication for online payments (Strong Customer Authentication – SCA) came into force, with which Stopanska Banka has fully complied. Enhanced authentication for online payments with Stopanska Banka payment cards is performed using the software token (M-token) of the Bank's mobile application. For this purpose, we inform you that it is necessary to be a user of the M-token through the m-banking application on your mobile device because authorization of online payments with Visa/Mastercard payment cards will take place through it. The use of SMS OTP codes is excluded from use.
To continue to pay online with your payment cards smoothly and securely, and if you are not yet a user of the Stopanska Banka mobile application, we encourage you to download it from Google Play, App Store or App Gallery and activate your M-token. Detailed information and instructions on using the mobile application and activating your M-token can be found in the Installation and Instructions section of m-banking on our website, in the Bank's branches or through the 24/7 Contact Center at 02/3100-109.
Strong authentication is implemented by almost all domestic and online merchants in Europe, while among online merchants outside the EU, implementation is partial and depends on the security standards used by the specific merchant, so increased caution is still required when using and paying for their services with such merchants (who do not support strong authentication).
Why is this change good for you?
This method, known as Strong Customer Authentication (SCA), offers several key advantages:
Greater security and integrity: It is difficult to intercept or misuse, you authenticate with biometrics.
Speed and simplicity: You approve the transaction using your fingerprint, facial recognition, or personal M-token payment code.
Control: You have full insight into the transaction details on your mobile device screen before confirming it.
Stopanska Banka is constantly improving its systems to provide you with the highest level of security when using your payment cards online.
Your safety is our priority.
Contactless payment security
For greater security of your payment cards and in accordance with the regulation on enhanced customer authentication when performing contactless card-based payment transactions, PIN code authentication is mandatory when performing contactless payment transactions with debit and credit cards issued by SB in the following cases:
If the card has made 5 consecutive contactless transactions at a POS terminal without a PIN (since the last transaction authenticated with a PIN), the next contactless transaction must be authenticated with a PIN by the client. Otherwise, it will be rejected.
If the total cumulative amount of all contactless transactions at the POS exceeds 9,000 denars (since the last transaction authenticated with a PIN), the next contactless transaction must be authenticated with a PIN, regardless of the transaction amount. Otherwise, it will be rejected.
If the individual amount of a contactless payment transaction at a POS terminal exceeds 3,000 denars, it must be authenticated with a PIN. Otherwise, it will be rejected.
After a transaction is made with a PIN, the amount/number of transactions is reset and contactless transactions can be made again.
IMPORTANT: If you have a declined contactless payment transaction, for which other reasons for decline (e.g. card status, account balance, daily limits, etc.) have been ruled out, please ask the merchant to perform a contact transaction with chip and PIN processing. After a contact transaction with PIN is made, the amount/number of transactions is reset and contactless transactions can be made again.
When paying with Google Pay, it is not necessary to enter a PIN code at a POS terminal, but it is mandatory for the mobile device to be unlocked in order to make the payment, regardless of the transaction amount. As an exception, only in very rare cases (most often due to an older terminal model) may a PIN be requested, in which case the PIN from the physical card must be entered.
When paying with Apple Pay, it is not necessary to enter a PIN code at a POS terminal, but authentication with Face ID, Touch ID, or your device's password is mandatory, regardless of the transaction amount.