Strong customer authentication (SCA) is the PSD2 requirement that a payment service provider verify a payer with at least two independent factors before an electronic payment or account access goes ahead, set out in Article 97 of Directive (EU) 2015/2366 and detailed in Delegated Regulation (EU) 2018/389. The factors must come from different categories: knowledge, such as a PIN; possession, such as a registered phone; and inherence, such as a fingerprint. Online card payments apply it through 3-D Secure 2, and remote payments add dynamic linking of the code to amount and payee. The rules applied from 14 September 2019. Exemptions cover low-value and low-risk payments, and an acquirer that requests one generally takes the fraud liability.
The three factor categories
Factors must come from two different categories: knowledge (a PIN or password), possession (a registered phone or card) and inherence (a fingerprint or face scan). Two passwords do not count, because they share a category. The factors must also be independent, so compromising one cannot reveal the other; an SMS one-time code plus a card number fails, since a card number is not a secret factor.
How does SCA work in a card payment
For online card payments SCA runs through 3-D Secure 2. The merchant sends transaction and device data to the issuer's access control server, which either approves frictionlessly under an exemption or challenges the cardholder, usually in the banking app with biometrics. Remote payments also require dynamic linking: the authentication code is tied to the exact amount and payee, so changing either invalidates it.
The rules applied from 14 September 2019. Enforcement for EEA e-commerce followed at the end of 2020, and the UK finished its phase-in in March 2022.
Exemptions and what falls outside scope
An SCA exemption lets the payer's PSP skip the challenge. The main ones: remote payments under EUR 30 (until five transactions or EUR 100 accumulate), contactless payments under EUR 50 (until five transactions or EUR 150), recurring payments of a fixed amount to the same payee, trusted beneficiaries, and transaction risk analysis for PSPs whose fraud rates stay under set thresholds. Merchant-initiated transactions and one-leg-out payments, where the issuer or acquirer sits outside the EEA, are out of scope rather than exempt.
Liability and conversion
The issuer always decides whether to grant an exemption. If the acquirer requests one and the payment later proves fraudulent, liability generally shifts to the acquirer side. A challenge adds friction: merchants that route every payment through a challenge see measurable drop-off, while those that request exemptions well keep most traffic frictionless.
SCA in licensing and diligence
SCA compliance is a supervisory topic for every EMI and PI in the EEA. A buyer of a licensed firm checks the authentication methods offered to its users, its exemption logic, fraud rates reported to the regulator, and whether any authority has raised findings on PSD2 authentication during recent inspections.
See also: OTP (One-Time Password).