Payments
Strong Customer Authentication (SCA)
Updated
Strong Customer Authentication is the European rule that most online payments must be confirmed with at least two of: something the buyer knows, has, or is.
SCA comes from the EU's second Payment Services Directive and, according to Stripe, has been in effect since 14 September 2019. It applies to customer-initiated online payments in Europe and the UK, and banks must decline payments that require it but do not meet it.
The three elements are knowledge (a password or PIN), possession (a phone or card) and inherence (a fingerprint or face). For card payments, merchants meet SCA through 3D Secure.
There are exemptions, such as some low-risk and low-value payments, and merchant-initiated payments like subscription renewals fall outside SCA when the first payment was authenticated. A bank can still ask for authentication on any payment, so checkouts must be able to show a challenge.
Frequently asked questions
- Does SCA apply to US stores?
- It applies when the payment is in scope in Europe, for example a business in the European Economic Area serving customers there. A US merchant selling to European cardholders will see European banks request authentication.
- Do subscription renewals need SCA?
- Merchant-initiated payments, such as renewals on a card saved with an authenticated first payment, are generally outside SCA, though the bank can still request authentication.