Strong customer authentication
SCAAlso called two-factor payment authentication, PSD2 authentication
Strong customer authentication is the requirement for payment service providers to verify a customer with at least two independent factors before online account access or an electronic payment. The factors come from something the customer knows, something they have and something they are. It applies in the EU and UK.
How it works
SCA is triggered when a payer accesses a payment account online, starts an electronic payment or carries out a remote action that could carry a risk of fraud. The provider checks two factors from different categories, such as a one-time passcode on a registered phone and a fingerprint. The factors must be independent, so a breach of one does not compromise the other. For remote payments, the authentication code is dynamically linked to the amount and payee.
The technical standards set out exemptions where the provider may skip SCA, including low-value contactless and online payments, trusted beneficiaries, recurring payments of the same amount, secure corporate payment processes and low-risk transactions identified through real-time transaction risk analysis. Merchant-initiated transactions fall outside SCA. Each provider decides whether to apply an exemption, and the payer's provider carries liability for unauthorised payments where SCA was not applied.
The rules
Requires strong customer authentication when a payer accesses an account online, initiates an electronic payment or carries out a remote action implying a risk of fraud.
Payment service providers in the EUSets the detailed requirements for authentication factors and dynamic linking, the exemptions from SCA and the rules for secure third-party access to accounts.
Payment service providers in the EUUK implementation of the PSD2 requirement to apply strong customer authentication, in force eighteen months after the EU technical standards.
UK payment service providersThe FCA's version of the EU standards after Brexit; PS21/19 removed the 90-day reauthentication requirement for account information access through a third-party provider.
UK payment service providersCommon questions
When does SCA apply?
SCA applies when a customer logs in to a payment account online, initiates an electronic payment, or carries out a remote action that could carry a risk of fraud. Card payments where the merchant initiates the transaction under an earlier mandate fall outside it.
What counts as an authentication factor?
Factors fall into three categories: knowledge, such as a PIN or password; possession, such as a registered phone or card; and inherence, such as a fingerprint or face scan. SCA needs at least two factors from different categories.
Does SCA apply in the US?
No. SCA is a UK and EU legal requirement. US firms use multi-factor authentication under federal banking guidance and their own risk policies, and US card payments to EU or UK merchants can still meet SCA through the card schemes' authentication protocols.
