What is Strong Customer Authentication?

Introduction to Strong Customer Authentication

Definition and core principles of strong customer authentication

Strong Customer Authentication (SCA) is a European regulatory framework, first introduced under the second payment service directive (PSD2) in the European Economic Area and retained in UK law through the Payment Services Regulation 2017, that describes three types of information that should be reviewed as part of an online payment transaction to increase security and reduce fraud. Merchants must have authentication technologies into their checkout flows that measure at least two of the following three elements (GOV.UK):

• “Something you know”, the KNOWLEDGE Element (e.g., password or PIN)
• “Something you have”, the POSSESSION Element (e.g., phone or hardware token)
• “Something you are” the INHERENCE Element (e.g., fingerprint or face recognition)

Strong authentication confirms user identity reliably and safely, never solely based on shared secrets/symmetric keys such as passwords, codes, and recovery questions. By requiring multiple, distinct layers of verification, strong authentication assumes credential phishing and impersonation attacks are inevitable and robustly repels them.

Why strong customer authentication matters

As the volume of online payments grows across the European Economic Area (EEA) and the UK, so does the sophistication of cybercriminals. SCA acts as a vital pillar of protection against payment fraud. For merchants, effectively navigating SCA requirements means safeguarding revenue, remaining compliant, and building trust with legitimate customers.

Regulatory and industry context

SCA was formalised as a core component of the Revised Payment Services Directive (PSD2) (European Commission), aiming to reduce fraud and make electronic payments more secure. As the industry evolves, staying compliant with these mandates ensures that payment service providers and merchants avoid penalties and maintain high authorisation rates.

Learn more about the history of ecommerce payment regulations and the differing rules across the world.

Regulatory Background and Scope

Overview of the Revised Payment Services Directive PSD2

PSD2 fundamentally shifted the payments landscape in Europe, enhancing consumer protection and fostering innovation through open banking. A key mandate of this directive was the introduction of strict SCA requirements for online payments to combat the rising tide of digital fraud.

SCA requirements under PSD2 and related regulations

Under PSD2, SCA requires that electronic payments be authenticated using at least two of three independent factors: knowledge, possession, and inherence. If one factor is compromised, the others remain secure, ensuring the transaction’s integrity.

Who must comply and which transactions are in scope

All electronic payments (i.e., card payments and bank transfers) require SCA unless an exemption can be applied or the transaction is considered out of scope for SCA—for example, merchant-initiated transactions such as direct debits (see regulatory technical standards, RTS, exemption). This applies broadly to merchants, payment service providers, and acquiring banks operating within the EEA and the UK (FCA).

Key timelines and implementation milestones

While PSD2 is fully enforced across Europe and the UK, the regulatory landscape continues to evolve. In mid-2023, the European Commission proposed the Third Payment Services Directive (PSD3) and the Payment Services Regulation (PSR). These updates will further refine SCA rules and expand liability for payment service providers in cases of spoofing and advanced fraud. The rollout is not yet confirmed however, the European Parliament and Council reached a provisional political agreement on the texts in November 2025, once formally adopted, this means the new rules are expected to start applying roughly from 2027 to 2028.

Learn more about the regulations that can have an impact on merchants in Europe and across the world.

Authentication Factors and Security Principles

The three categories of authentication factors

To satisfy SCA, an authentication flow must incorporate two out of the three following independent factors:

Knowledge factors something the customer knows

This is a piece of information uniquely known to the user, such as a password, PIN, or the answer to a secret question.

Possession factors something the customer has

This involves a physical item belonging to the user, such as a smartphone, a hardware token, or a smart card.

Inherence factors something the customer is

This refers to biometric data unique to the individual, such as fingerprint scans, facial recognition, or voice and behavioural analytics.

Dynamic linking and transaction integrity

For remote financial transactions, SCA requires “dynamic linking.” This means the authentication token generated for the transaction must be explicitly linked to the specific transaction amount and the specific payee. If either changes, the authentication code becomes invalid (UK Finance).

Risk based and adaptive authentication approaches

Modern payment platforms use adaptive, risk-based authentication to determine whether to challenge a user. By analysing data points like device IP, location, and spending habits in real time, systems can often authenticate users seamlessly in the background without overt interruption.

How Strong Customer Authentication Works in Practice

Typical SCA user journeys for card payments

When a customer initiates an online payment, the merchant’s payment gateway routes the request through a EMV 3D Secure (3DS) protocol. If SCA is required, the issuing bank prompts the customer to authenticate—often via a push notification to their banking app (possession) requiring a fingerprint scan (inherence).

Learn more about 3D Secure (3DS) protocol, and how it works to protect online card payments

SCA flows in online and mobile banking

Within mobile banking apps, SCA is often frictionless. Customers log in using a biometric scan, and when initiating a bank transfer, the app dynamically links the transaction details and securely requests confirmation without forcing the user to leave the interface.

SCA in ecommerce checkouts

For e-commerce merchants, the challenge is inserting SCA into the checkout without causing cart abandonment. If a transaction requires a “step-up” challenge, the shopper is temporarily redirected or shown a modal from their bank to complete the 2FA process before the order is confirmed.

Customer experience and usability considerations

SCA inherently adds friction to the buying journey. Striking the right balance is crucial; overly aggressive authentication can frustrate buyers and damage conversion rates. Retailers must optimise their checkouts to ensure that when SCA is unavoidable, the user interface remains intuitive and clear.

Exemptions and Out of Scope Transactions

Low value and contactless payment exemptions

Transactions under €30 (or regional equivalents) are typically exempt from SCA, provided the customer hasn’t exceeded the cumulative limit of five consecutive low-value payments or a total of €100 since their last strong authentication (under article 16 of SCA RTS).

Transaction risk analysis exemptions

Transaction Risk Analysis (TRA) allows merchants and their payment service providers to bypass SCA for orders up to specific values (e.g., €100, €250, or €500) if their overall fraud rate remains below strict regulatory thresholds (under article 18 of SCA RTS). Utilising TRA through a robust fraud management platform is one of the most effective ways to boost conversion rates and bypass unnecessary friction.

Trusted beneficiaries and whitelisting

Customers can ask their card-issuing bank to add a specific merchant to a “trusted beneficiary” list. Once whitelisted, subsequent purchases from that merchant can bypass the SCA requirement entirely (under article 14 of SCA RTS).

Recurring payments and merchant initiated transactions

Subscription renewals and direct debits are generally out of scope for SCA because they are Merchant-Initiated Transactions (MITs). SCA is only required on the very first transaction when the payment mandate is established by the customer (covered under article 14 of SCA RTS).

Corporate payments and secure corporate processes

B2B payments made via dedicated, secure corporate payment processes (such as a centralised corporate travel booking system) are exempt, as they rely on secure protocols managed outside the consumer space (under article 17 of SCA RTS).

Out of scope scenarios and special cases

Mail Order and Telephone Order (MOTO) transactions, as well as “one-leg-out” transactions (where either the issuer or the acquirer is located outside the EEA/UK), fall outside the scope of the SCA mandate (clarified in the European Bank Authority, EBAs, on the implementation of the regulatory technical standards on SCA)

Learn more about strong customer authentication exemptions and how to utilise transaction risk analysis.

Technologies and Methods Used for SCA

One time passwords and app based authenticators

SMS-based One-Time Passwords (OTPs) were historically popular but are increasingly being replaced by app-based push notifications due to the vulnerability of SMS to interception and spoofing, reflecting the EBA’s warnings on SMS interception and SIM-swap fraud.

Biometric authentication methods

Biometrics have become the gold standard for seamless SCA. Fingerprint and facial recognition via smartphones satisfy the “inherence” factor quickly, safely, and with minimal user friction.

Hardware tokens and security keys

Though less common in everyday retail checkouts, hardware tokens (like USB security keys or bank-issued card readers) remain a highly secure “possession” factor, often utilised in corporate banking or high-value transfers.

3D Secure 2 and payment scheme frameworks

EMV 3D Secure 2 (3DS2) is the primary messaging protocol used by card networks to facilitate SCA. Unlike its predecessor, 3DS2 allows merchants to send rich data payloads to the issuer, enabling better risk-based decisions and smoother friction-free flows.

Device binding and secure customer devices

Binding a specific mobile device to a user’s account acts as a powerful “possession” factor. Banks use cryptographic keys stored securely on the user’s phone to verify that transactions are genuinely originating from the customer’s trusted device.

Implementation Challenges for Businesses

Technical integration with banks and payment service providers

Deploying SCA requires complex technical synchronisation between the merchant’s platform, their payment gateway, acquiring banks, and the issuing banks via the 3DS2 framework.

Balancing security with conversion and user experience

The primary challenge for merchants is mitigating cart abandonment. Every additional step in the checkout risks losing a sale, making it vital to deploy strategies that route legitimate traffic through the path of least friction.

Legacy systems and migration issues

Older payment infrastructures may struggle to support the rich data requirements of 3DS2 or the dynamic routing needed to request TRA exemptions, necessitating costly tech stack upgrades.

Handling cross border and multi jurisdiction requirements

Merchants selling internationally must navigate a patchwork of enforcement timelines and local interpretations of SCA rules, especially when distinguishing between in-scope EEA transactions and out-of-scope global payments.

Monitoring, logging, and fraud analytics

To maintain low fraud rates—and thus qualify for valuable TRA exemptions—businesses must invest in real-time fraud analytics that accurately distinguish between bad actors and good customers prior to bank authorisation (EBA’s guidance on real-time TRA monitoring)

Designing a Customer Centric SCA Strategy

Mapping user journeys and risk profiles

A successful strategy begins with mapping out every payment touchpoint. By understanding the typical risk profile of their audience, merchants can tailor authentication flows to specific scenarios rather than applying a blanket approach.

Choosing appropriate authentication factors

Whenever possible, lean on authentication methods native to the user’s device, such as Apple Pay or Google Pay, which inherently satisfy SCA via biometrics without pulling the user out of the shopping experience.

Minimizing friction with step up authentication

Only trigger a “step-up” challenge when absolutely necessary. By relying on robust pre-authorisation fraud screening, merchants can confidently request exemptions and reserve high-friction SCA challenges for genuinely suspicious activity.

Accessibility and inclusivity considerations

Authentication methods must cater to all users, including those without smartphones or those with visual or motor impairments. Offering alternative compliance paths, such as landline voice codes or physical card readers, ensures inclusivity.

Communication and customer education

Proactively explaining why a payment is being challenged helps alleviate customer frustration. Clear on-screen messaging about security and fraud protection can turn a moment of friction into an opportunity to build trust.

Compliance, Governance, and Risk Management

Roles and responsibilities within organizations

Achieving and maintaining compliance requires cross-functional collaboration. Risk and fraud personnel, legal teams, and product managers must align to ensure the checkout is both legally sound and commercially viable.

Policies, procedures, and documentation

Organisations must maintain rigorous documentation of their payment flows, fraud thresholds, and exemption strategies to prove compliance during regulatory audits or acquiring bank reviews.

Working with regulators and industry bodies

Staying engaged with local regulatory bodies helps businesses anticipate shifts in enforcement and adapt to incoming regulations smoothly.

Auditing, testing, and continuous improvement

SCA is not a “set and forget” initiative. Merchants must continuously monitor their exemption success rates, soft declines, and overall checkout conversion, adjusting their routing logic to optimise performance.

Future Trends in Strong Customer Authentication

Advances in biometrics and behavioral analytics

The future of inherence factors lies in continuous behavioural analytics. By monitoring how a user types, holds their phone, or navigates a site, systems can authenticate users invisibly throughout the session.

Continuous and invisible authentication models

Rather than a single checkpoint at payment, continuous authentication assesses risk from the moment a user logs in, creating a seamless background layer of security that eliminates the need for checkout interruptions.

Impact of open banking and open finance

As open banking adoption grows, Account-to-Account (A2A) payments will increasingly embed SCA directly within the bank’s own highly secure app environments, completely bypassing traditional card networks and their associated checkout friction.

Emerging standards and global regulatory developments

With PSD3 and the Payment Service Regulation set to reshape the landscape in 2027, the EU is moving to strengthen rules around API performance, expand liability for spoofing fraud, and push for even greater standardisation of identity verification across digital wallets and payment methods.

Conclusion and Key Takeaways

Summary of essential SCA concepts

Strong Customer Authentication is a mandatory framework that secures the digital economy by requiring two independent verification factors for electronic transactions. While it introduces new challenges for the user experience, it effectively curtails payment fraud when implemented correctly.

Strategic recommendations for businesses

Merchants should view SCA not merely as a compliance hurdle, but as an opportunity to optimise their payment flows. By investing in advanced fraud management and leveraging Transaction Risk Analysis (TRA), businesses can maximise exemptions, reduce friction, and protect their bottom line.

Preparing for ongoing evolution in authentication

With regulations like PSD3 approaching, the payments ecosystem will continue to evolve. Businesses must remain agile, prioritising customer-centric, frictionless authentication methods to stay ahead of both fraudsters and regulatory shifts.

Payment optimisation

Approve more good orders

Signifyd helps merchants apply frictionless conversions for legitimate customers. Helping merchants convert more good orders and boosting approval rates.

Learn more