Overview
Strong Customer Authentication (SCA) is a mandatory security requirement under the EU’s Second Payment Services Directive (PSD2). It aims to reduce fraud and enhance the security of electronic payments. SCA applies to most online card payments and all bank transfers within the European Economic Area (EEA), unless the transaction qualifies for an exemption or is out of scope.
SCA Requirements
To comply with SCA, authentication must use at least two of the following three elements:
Knowledge – something the customer knows (e.g., password, PIN)
Possession – something the customer has (e.g., mobile phone, hardware token, wearable, one-time password (OTP) via SMS)
Inherence – something the customer is (e.g., fingerprint, face recognition, voice)
These elements must be independent, so that the breach of one does not compromise the others.
Implementation Timeline
14 September 2019: SCA requirements came into force.
31 December 2020: Final deadline for full enforcement across the EEA.
As of this year, SCA compliance is fully enforced, and non-compliant transactions are likely to be declined.
Authentication Methods
3D Secure (3DS)
For online card payments, SCA is typically fulfilled using the 3D Secure (3DS) authentication protocol. The latest version, 3DS 2.0, offers a more seamless user experience, including:
Biometric authentication (e.g., fingerprint or facial recognition)
Risk-based authentication, allowing low-risk transactions to be approved without additional customer input
Integration with mobile devices, reducing friction during checkout
Note: While 3DS 2.0 is widely adopted, the specific authentication method is determined by the cardholder's issuing bank.
Other Methods
Alternative payment methods, such as Apple Pay and Google Pay, inherently support SCA through built-in biometric or passcode authentication.
Exemptions and Out-of-Scope Transactions
Certain transactions may be exempt from SCA or considered out of scope, including:
Low-value transactions (below €30)
Recurring payments with the same amount and payee
Trusted beneficiaries added by the customer
Corporate payments using dedicated payment processes
Mail order and telephone orders (MOTO)
Exemptions are subject to the issuing bank's discretion and risk assessment.
Future Developments: PSD3
The upcoming Third Payment Services Directive (PSD3) is expected to further refine SCA requirements, including:
Clarifying exemption criteria
Extending SCA to additional scenarios, such as mobile wallet enrollments
Enhancing fraud prevention measures
Merchants should stay informed about PSD3 to ensure ongoing compliance.