Strong Customer Authentication is a European regulatory requirement, introduced under PSD2, that most electronic payments be authenticated with two independent factors. In practice it is why European checkouts trigger a bank app approval — usually implemented through 3D Secure 2.
The three factors
| Category | Examples |
|---|---|
| Knowledge — something you know | Password, PIN, security question |
| Possession — something you have | Phone, card reader, hardware token |
| Inherence — something you are | Fingerprint, face, voice |
They must be from different categories and genuinely independent. A password plus a security question is not SCA; both are knowledge.
Who is actually in scope
This is the part most often misunderstood. SCA applies when both the cardholder''s issuing bank and the merchant''s acquirer are in the EEA or UK. A US business with a US acquirer selling to a customer in Berlin is generally out of scope — though the issuer may still request authentication.
The exemptions worth knowing
- Merchant-initiated transactions. Recurring charges you initiate after an authenticated first payment. This is what keeps subscriptions working.
- Low value. Under €30, subject to cumulative caps of roughly five transactions or €100 since the last authentication.
- Transaction risk analysis. Low-risk transactions can be exempted, with the threshold depending on the acquirer''s overall fraud rate.
- Trusted beneficiaries. A customer can allowlist your business with their bank.
- Corporate cards. Secure corporate payment processes can be exempt.
Exemptions are requested by the acquirer and granted — or refused — by the issuer. A good provider requests them automatically where they apply, which is why SCA-region conversion varies noticeably between processors.
What it means practically
If you sell into Europe with a European acquirer, ensure your integration supports 3DS2, authenticate the first payment of any subscription, and confirm your provider requests exemptions rather than challenging everything. The difference between a good and a lazy implementation is measured in completed checkouts.
GOOD QUESTIONS
Frequently asked
Does SCA apply to US businesses?+
It applies when both the cardholder's bank and the merchant's acquirer are in the EEA or UK. A US company with a US acquirer selling to a European customer is generally out of scope — but if you have a European entity or acquirer, you are in scope.
What counts as two factors?+
Two of three categories: something you know (a password or PIN), something you have (a phone or card reader), and something you are (a fingerprint or face). Two passwords do not count — they are the same category.
Do subscriptions need SCA every time?+
No. The first payment generally requires authentication, and subsequent fixed-amount charges you initiate are treated as merchant-initiated transactions and exempt. If the amount changes, you may need to authenticate again.
What is the low-value exemption?+
Transactions under €30 can be exempted, subject to cumulative limits — typically five consecutive exempt transactions or €100 total since the last authentication, after which the next one is challenged.