Strong Customer Authentication (SCA)

Strong Customer Authentication (SCA) is a regulatory requirement under the European Union's Second Payment Services Directive (PSD2) that a payment service provider verify the identity of a payer using at least two independent elements from three categories: something the user knows, something the user possesses and something the user is. It applies when a payer accesses a payment account online, initiates an electronic payment, or carries out any remote action that may imply a risk of fraud.

SCA applies across the European Economic Area and, through retained law, in the United Kingdom. It is a specific legal form of multi-factor authentication, and its practical effect depends heavily on a defined set of exemptions.

The requirement is set out in Article 97 of Directive (EU) 2015/2366 (PSD2). The detailed rules are in the Regulatory Technical Standards on strong customer authentication and common and secure communication, adopted as Commission Delegated Regulation (EU) 2018/389 after drafting by the European Banking Authority. The standards applied from 14 September 2019, but national regulators allowed extra time for card-based e-commerce, with the EBA setting 31 December 2020 as the end of that period. The UK Financial Conduct Authority set its own later date for full e-commerce enforcement.

• Knowledge: something only the user knows, such as a password, PIN or answer to a secret question. Knowledge-based authentication alone is never enough.
• Possession: something only the user has, such as a registered mobile phone, a hardware token or a card, often proven with a one-time password or a cryptographic key in an app.
• Inherence: something the user is, such as a fingerprint or face scan, drawn from biometric data.

The two elements must come from different categories and be independent, so that the breach of one does not compromise the other. For remote payments, the authentication must also be dynamically linked to the amount and payee, so that a code generated for one transaction cannot be reused for another.

The technical standards define circumstances in which the payer's provider may choose not to apply SCA. The main ones are:

• Low-value remote payments of up to €30, subject to cumulative limits of €100 or five consecutive transactions since the last authentication.
• Contactless payments at the point of sale of up to €50, subject to cumulative limits.
• Trusted beneficiaries that the payer has whitelisted with its own provider.
• Recurring transactions of the same amount to the same payee, after the first.
• Transaction risk analysis, where the provider's fraud rate is below set thresholds, allowing remote payments up to €100, €250 or €500 to skip SCA.
• Secure corporate payment processes and unattended terminals for transport fares and parking.

The issuer, not the merchant, has the final say on whether an exemption applies. Some transactions fall outside the scope of SCA altogether: merchant-initiated transactions, such as subscription renewals agreed in advance, mail and telephone orders, and "one-leg-out" payments where the payer's or payee's provider is outside the EEA, on a best-efforts basis.

For online card payments, SCA is usually delivered through EMV 3-D Secure version 2, which lets the merchant send the issuer extensive data about the transaction and device. The issuer can then approve frictionlessly, apply an exemption or "step up" to a challenge, such as a banking-app approval. This has reduced card-not-present fraud, though early implementation also caused higher cart abandonment for e-commerce payments.

If a payer's provider does not require SCA, the payer generally bears no financial loss for an unauthorized transaction, except where the payer acted fraudulently. If the payee or its provider fails to accept SCA, it must refund the payer's provider. SCA does not stop authorized push payment fraud, where victims are tricked into authenticating payments themselves. The EU's proposed Payment Services Regulation and PSD3 would refine the rules, including on open banking access.

• European Banking Authority