Strong Customer Authentication (SCA) is a security requirement introduced under the European Union's Payment Services Directive 2 (PSD2) to increase security and reduce fraud in online payment transactions.
SCA requires that an online payment transaction use a combination of two of the following three independent authentication factors. This process is also known as two-factor authentication.
- Something the user knows (the KNOWLEDGE element). For example, a password, PIN, or a knowledge-based question.
- Something the user has (the POSSESSION element). For example, a card, a phone, an OTP, etc.
- Something that identifies the user biometrically (the INHERENCE element). For example, fingerprint, facial recognition, iris recognition, or voice recognition.
Is SCA currently active?
Not yet. According to the latest announcement by the EBA (European Banking Authority), the SCA enforcement date was set to begin on December 31, 2020.
In which cases is SCA required?
Strong Customer Authentication will apply to "customer-initiated" online payments within the European Economic Area (EEA).
In which cases is SCA not required?
Low-Value Transactions
Transactions under 30 Euros are considered "low-value" and may be exempt from SCA. However, if the exemption has been used five times since the cardholder's last successful authentication, or if the total of previously exempted payments exceeds 100 Euros, banks will be required to request authentication. The cardholder's bank must track how many times this exemption has been used and decide whether authentication is required.
Low-Risk Transactions
A payment provider will be permitted to perform a real-time risk analysis to determine whether SCA should be applied to a transaction. This is only possible if the fraud rates applicable to card payments for the payment provider and the bank do not exceed the following thresholds.
| Fraud Rate | Exemption Amount |
| 0.13% | Transactions under €100 |
| 0.06% | Transactions under €250 |
| 0.01% | Transactions under €500 |
Recurring and Merchant-Initiated Transactions
The exemption can apply when a customer authorizes a merchant for a series of recurring payments of a fixed amount. SCA is required for the customer's first payment; subsequent transactions are initiated by the merchant and may be exempt from SCA. If the transaction amount changes, SCA will be required again.
The exemption also covers recurring business scenarios where the transaction amount is "variable" over time. For example, some products/services have a cost per period that varies based on usage. Such transactions are considered "merchant-initiated transactions" and are exempt from SCA requirements.
MOTO Transactions
Mail Order and Telephone Order (MOTO) transactions will be exempt from SCA in all cases. MOTO transactions are not considered "electronic" payments, and are therefore outside the scope of the regulation.
Trusted Merchants
While completing authentication for a payment, customers may have the option to whitelist a merchant they trust in order to avoid authenticating future purchases. Such merchants will be included in a "trusted beneficiaries" list maintained by the customer's bank or payment service provider.
Cross-Regional Transactions
In an online payment transaction, if either the cardholder's bank (Issuer) or the merchant's acquiring bank (Acquirer) is not located in Europe, the transaction is considered exempt from SCA requirements.
