Strong Customer Authentication (SCA)

Strong Customer Authentication (SCA) is a European rule that requires many online and contactless card payments to be verified with two independent factors. PSD2 introduced it. In practice, SCA is what triggers a 3D Secure check at checkout, such as a passcode, a banking app approval, or a fingerprint.

The two-factor rule

SCA requires two of these three factor types:

• Something the customer knows, like a password or PIN.
• Something the customer has, like a phone or hardware token.
• Something the customer is, like a fingerprint or face scan.

With two factors from different types, a stolen password alone is not enough. When a payment needs SCA, the customer's bank (the issuer) runs the check and decides whether to approve.

Exemptions

Not every payment gets a challenge. Common exemptions include:

• Low-value payments under €30, until the card reaches five such payments or €100 in total.
• Transaction risk analysis for merchants with low fraud rates.
• Recurring charges of a fixed amount.
• Payees the customer has added to a trusted list.

Merchant-initiated transactions, such as a subscription renewal charged in the background, are usually out of scope if the customer authenticated at setup. The issuer always decides whether to accept an exemption.

Why it matters

A payment that needs SCA and doesn't get it is usually declined. Subscription businesses should authenticate the card at signup so later renewals count as merchant-initiated. Watch your declined payments to catch authentication failures early.