Strong Customer Authentication (SCA) and Your Checkout
If a European customer has ever abandoned your checkout at the "confirm in your banking app" step, you have met Strong Customer Authentication. SCA is an EU rule that requires most online payments to be verified with two factors. This explainer covers how it works, which exemptions exist, who decides when they apply and how to make the extra step as painless as possible. It is general information, not legal or payments advice.
Key takeaways
- Under PSD2, Strong Customer Authentication has applied to most electronic payments in the EEA since 31 December 2020, and in the UK fully since 14 March 2022.
- SCA means two of three factors: something the customer knows, has or is.
- For card payments, it usually runs through 3-D Secure 2.
- Exemptions exist, but the card issuer makes the final decision.
- A modern payment setup and a mobile-friendly checkout reduce failed authentications and drop-off.
SCA was introduced to cut online payment fraud. For shoppers, it means an extra moment of verification. For merchants, it means one more step where a sale can fail: the customer does not have their phone, the banking app times out or the pop-up does not display properly on mobile.
You cannot switch SCA off, but you can control a lot about how it feels. This article explains the rule in plain terms and then focuses on what a small online shop can do about it.
What SCA is and where it applies
Strong Customer Authentication comes from the revised Payment Services Directive, known as PSD2. It requires payment service providers, in particular the banks that issue cards, to verify the customer with at least two independent factors for most electronic payments that the customer starts.
In practice, SCA matters when both the customer's card issuer and your payment provider are in the EEA or the UK. If you sell from outside Europe, your payment provider's location and setup affect how SCA applies to your transactions, so check with your provider.
The three factors
| Factor | Meaning | Examples |
|---|---|---|
| Knowledge | Something the customer knows | Password, PIN |
| Possession | Something the customer has | Phone with a banking app, a device receiving a one-time code |
| Inherence | Something the customer is | Fingerprint, face recognition |
Card details alone do not count as a strong factor. That is why a shopper typically has to approve the payment in their banking app, often with a fingerprint or face scan, which combines possession and inherence.
How 3-D Secure 2 fits in
For card payments, SCA is usually carried out through 3-D Secure 2, often shortened to 3DS2. Card schemes market it under their own names. When a customer pays:
- Your checkout sends the payment to your payment provider, along with data about the transaction and device.
- The provider passes the request through the card network to the customer's card issuer.
- The issuer assesses the risk. Using the data shared, it decides whether to approve without a challenge, for example under an exemption, or to ask for authentication.
- If challenged, the customer verifies, typically in their banking app or with a code.
- The issuer approves or declines and the result returns to your checkout.
3DS2 shares far more data than the older version, which lets issuers approve more low-risk payments without a challenge. Your provider and store platform must support it properly for this to work.
Common mistake
Running an old payment plugin or a custom integration that was never updated for 3DS2. Payments may fail outright, show a broken challenge window on mobile or get declined more often than they should. If your checkout code or plugin is several years old, check it with your payment provider.
Exemptions and who decides
PSD2 includes exemptions that allow some payments to go through without a challenge. The main ones relevant to online shops are:
- Low-value transactions. Small payments may be exempt, subject to limits on amounts and on how many exempt payments happen in a row.
- Merchant-initiated transactions. Recurring or later payments you take under an agreement the customer authenticated once, such as a subscription.
- Trusted beneficiaries. A customer can add a merchant to a trusted list with their bank, where the bank supports it.
- Transaction risk analysis. Payment providers with low fraud rates may request an exemption for transactions they assess as low risk.
Pro tip
Your provider can request an exemption, but the card issuer decides. Even an eligible payment may be challenged if the issuer prefers. Design your checkout assuming a challenge can happen on any payment, and treat exemptions as a bonus that reduces friction when they apply.
Subscriptions and saved cards
If you sell subscriptions or save cards for faster repeat purchases, set them up so the first payment is authenticated and later charges are flagged correctly as merchant-initiated. Your payment provider usually handles the technical flags if you use its subscription or saved-card features rather than building your own.
Reducing drop-off at checkout
Failed authentication causes checkout drop-off. You cannot remove the step, but you can make it smoother and give customers a way forward when it fails.
Example
Imagine a small shop that sells phone accessories and notices that card payments from mobile visitors fail more often than on desktop. The owner tests the checkout on his own phone and finds the authentication window opens awkwardly inside an embedded frame. After switching to his provider's current hosted checkout component, the bank app opens cleanly and returns to the shop. He also adds Apple Pay and Google Pay, which let shoppers authenticate with their phone's built-in verification.
- Use your provider's current checkout components. Hosted or embedded components are usually kept up to date with 3DS2 changes.
- Share good data. Pass accurate billing details, email and device information so issuers can approve more payments without a challenge.
- Test on mobile. Make a real purchase on a phone and follow the jump to the banking app and back.
- Offer wallets. Apple Pay and Google Pay use the phone's own biometrics, which can make SCA feel almost invisible.
- Add local alternatives. Bank-based methods such as iDEAL or Blik have authentication built in, which shoppers already know.
- Write clear error messages. If authentication fails, tell the shopper what happened and let them retry or pick another method without losing their cart.
- Watch your numbers. Check authentication and decline rates in your provider's dashboard by country and device.
Phone orders, invoices and other edge cases
Not every payment in a small shop runs through a standard online checkout. A few common situations work differently, and it helps to know where they sit before a customer asks.
Orders taken by phone or email
If a customer reads card details to you over the phone or by email and you key them in, the payment is generally treated as a mail order or telephone order. These are usually outside the scope of SCA because the customer does not start the payment electronically themselves. That does not make them risk-free: you carry more fraud exposure, and card details sent by email are a security problem in their own right. Where possible, send the customer a secure payment link instead, which runs through your provider's normal authenticated flow.
Payment links and invoices
Payment links and online invoices from your provider are paid by the customer through a hosted page, so SCA normally applies in the same way as at checkout. Make sure the link opens properly on a phone and that the customer can complete the banking app step without losing the page.
Changing the order amount after payment
If you authorize a payment and then need to charge more, for example because the customer adds an item or shipping costs change, the extra amount may need a new authentication. Rather than adjusting the charge yourself, ask your provider how it handles increased amounts, or send a separate payment link for the difference.
Free trials and pre-orders
Free trials that convert to paid subscriptions, and pre-orders charged when goods ship, both involve taking money later. Set them up so the customer authenticates at sign-up and the later charge is flagged correctly by your provider. A surprise authentication request weeks after the order is a common reason these payments fail.
Your SCA checkout checklist
- Confirm with your payment provider that your integration fully supports 3DS2
- Update old payment plugins or custom checkout code
- Test a full card payment on mobile, including the banking app step
- Pass accurate billing, email and device data with each payment
- Set up subscriptions and saved cards through your provider's tools
- Offer Apple Pay, Google Pay and relevant local methods
- Show a clear message and retry option when authentication fails
- Review authentication and decline rates by country each month
Frequently asked questions
Does SCA apply to customers outside Europe?
SCA mainly applies when both the customer's card issuer and the merchant's payment provider are in the EEA or the UK. Payments involving issuers elsewhere may follow different rules. Your provider can tell you how it handles these cases.
Can I choose to skip SCA for loyal customers?
No. You or your provider can request an exemption where one applies, but the card issuer makes the final decision. A customer can, where their bank allows it, add you as a trusted beneficiary.
Is PayPal affected by SCA?
Wallets and other payment methods have their own ways of meeting SCA requirements, usually built into their login or approval flow. You do not normally need to add anything yourself.
Who is liable for fraud after SCA?
Liability depends on card scheme rules and whether the payment was authenticated or exempt. Ask your payment provider how liability works for your account.
Related reading
The bottom line
Strong Customer Authentication is a permanent part of online payments in Europe and the UK. Two-factor verification protects shoppers and merchants from fraud, but every extra step is a chance for a sale to fail. Keep your payment integration current, test the flow on mobile, share good transaction data and offer wallets and local methods that make authentication feel natural.
This is general information, and payment rules and card scheme requirements change. Check the European Commission's PSD2 guidance, GOV.UK for UK sellers and your payment provider's documentation before you change your checkout.
