Strong Customer Authentication (SCA)
Also known as: SCA, PSD2 SCA, two-factor payment authentication
Strong Customer Authentication (SCA) is a European and UK legal requirement that most online payments and banking logins be verified with at least two independent factors: something you know, something you have, or something you are.
While SCA is often described as a security upgrade, it's really a legal mandate that forced the whole industry to adopt modern authentication on a deadline. It's why European shoppers approve so many purchases in their banking apps.
Strong Customer Authentication (SCA), explained at three levels
At home
Strong Customer Authentication works like a safety deposit box that needs two different keys: one you carry and one you know or are. In Europe and the UK, when you pay online or log in to your bank, you must show two kinds of proof from different categories, such as a password plus a phone code, or your phone plus your fingerprint. A thief who steals just one of them still can't get in.
At work
Strong Customer Authentication is a legal requirement in the EU, the EEA, and the UK that most electronic payments and online banking logins be verified with two independent factors. For merchants, it applies mainly to online card payments, where the customer's bank enforces it, usually through 3-D Secure. A business selling into those markets needs a checkout that supports it, or payments from customers whose banks require authentication will be declined.
At home
SCA groups proof into three categories: knowledge, such as a PIN or password; possession, such as your phone or card; and inherence, such as a fingerprint or face scan. Two factors must come from different categories and be independent, so stealing one doesn't reveal the other. A password plus a security question doesn't count, since both are knowledge. A banking app that asks for your fingerprint on your registered phone does, because it combines inherence with possession. Some small or low-risk payments are exempt.
At work
SCA rules come from the PSD2 regulatory technical standards, which require authentication unless an exemption applies. Common exemptions cover low-value payments under 30 euros, with cumulative limits, trusted beneficiaries the customer has whitelisted, recurring payments of the same amount, and transaction risk analysis for providers whose fraud rates stay below set thresholds. Merchant-initiated transactions, such as subscription renewals, fall outside SCA entirely once the first payment is authenticated. Exemptions are requests, not rights: the issuer has the final say and can still require authentication.
At home
SCA also requires 'dynamic linking' for remote payments: the authentication code must be cryptographically tied to the specific amount and payee, and the customer must see both while approving. If a man-in-the-middle changes the amount or the recipient, the code no longer matches and the bank rejects it. While that's a clever defence against technical tampering, it does nothing when you are persuaded to approve a payment to a scammer yourself. In my opinion, that gap is why regulators have shifted toward reimbursement rules.
At work
SCA's blind spot is authorized push payment fraud, where the genuine customer authenticates a payment to a scammer. Regulators have shifted toward liability rules to address that, like the UK's 2024 mandatory reimbursement scheme and EU proposals that make providers share responsibility in certain impersonation scams. Outside Europe, SCA isn't legally required, but it shapes global practice because merchants selling into Europe must support it.
Real-world examples
At home
Aisha, living in Berlin, booked a train ticket online. Her bank's app asked her to confirm the €89 payment with her fingerprint, and the screen showed the exact amount and the rail company's name. That dynamic link meant the approval couldn't be reused for any other payment.
At work
Jerome runs a Canadian subscription box company with many UK customers. When UK enforcement began, payments started failing for customers whose banks required authentication. His team set up SCA on initial sign-up and used the merchant-initiated exemption for monthly renewals, and failures dropped.
Common confusions
- SCA means a text message code. — SMS codes are one way to prove possession, but banks increasingly use app approvals and biometrics, which are harder to phish.
- SCA applies everywhere. — It's a legal requirement in the EU, the EEA, and the UK. Other countries have their own rules, though many follow similar practices.
- If I authenticated a payment, I can't be scammed. — SCA confirms you approved the payment. It doesn't confirm the recipient is honest, which is why authorized push payment fraud is a separate problem.
For analysts
Regulatory security mandates succeed or fail at the checkout page. If your business sells into Europe, I'd monitor authentication failure rates by country and bank, because a single issuer's strict policy can quietly drain revenue for months before anyone notices.
History & origin
SCA comes from the EU's second Payment Services Directive (PSD2), adopted in 2015, and the detailed technical standards that applied from September 14, 2019. The industry wasn't ready, so European regulators allowed a grace period for online card payments until the end of 2020, and the UK pushed its enforcement back to March 14, 2022. 3-D Secure 2 became the main way to meet SCA for online card payments. The EU later proposed replacing PSD2 with a new directive (PSD3) and a directly applicable Payment Services Regulation, which moved through EU lawmaking in 2025 with changes to fraud liability. In my view, SCA's delays showed that a regulator can set a deadline, but it can't make thousands of merchants upgrade their checkouts overnight.