Also called: SCA, PSD2, Payment Services Directive 2, Revised Payment Services Directive
What Strong Customer Authentication is
Strong Customer Authentication (SCA) is a security requirement introduced under the European Union’s revised Payment Services Directive, known as PSD2. For covered remote electronic payments, the customer must verify their identity using at least two independent factors. The requirement took effect for remote payments on September 14, 2021.
The factors come from three groups: something the customer knows, such as a password; something they have, such as a phone; and something they are, such as a fingerprint. Two passwords do not count as two independent factors because both are knowledge factors. SCA is a rule about authentication, not a standard card-processing fee.
SCA is a European authentication rule, and an unfinished authentication request can cost you the sale.
How SCA changes checkout
For online card payments, 3-D Secure is the main way to request SCA. A customer might approve a payment in a banking app, enter a one-time code, or use a biometric check. That extra step can interrupt checkout, while a payment that requires authentication but does not complete it can be declined.
The customer’s bank decides whether to require authentication. Some transactions qualify for exemptions, but an exemption request does not guarantee that the bank will approve the payment without a challenge. A successful 3-D Secure authentication generally shifts liability for a fraudulent dispute to the issuer, subject to exceptions. An exemption without authentication does not provide that shift.
What it means for a US business
SCA is not a general US payment requirement. The rule covers payments within its European scope, including cases where both the card issuer and acquirer are based in the European Economic Area (EEA). A US business that sells to an EEA customer is not automatically covered just because the customer is in Europe. Your business could encounter SCA through an EEA operation, an EEA acquiring setup, or a payment platform that processes for EEA-based accounts.
SCA does not have a standard statement line or published per-transaction fee in the materials reviewed. Its direct business effects are checkout completion, fraud controls, and dispute liability. For example, if an EEA bank requires authentication and your checkout cannot handle the request, the payment can fail before you collect the sale. Review failed-payment logs for authentication requests, incomplete 3-D Secure challenges, and soft declines, which signal that a payment needs another authentication attempt.
What you can actually change
- Check your sales footprint. Identify whether you have an EEA operation, an EEA acquirer, or connected accounts based in the EEA. A European customer alone does not establish that SCA applies.
- Test the challenge flow. Run successful and unsuccessful 3-D Secure tests, including what happens when a bank requests authentication after checkout. Confirm the customer can return and finish paying.
- Track failed attempts. Separate authentication failures, incomplete challenges, and soft declines in payment logs. These tell you whether a lost sale came from a customer abandoning checkout or an unfinished bank request.
Frequently asked questions
Does SCA apply to US businesses?
SCA is a European rule, not a general US requirement. A US business can encounter it through an EEA operation, acquiring setup, or connected account. A customer’s European location alone does not establish that the transaction falls within SCA’s scope.
Is SCA the same as 3-D Secure?
No. SCA is the authentication requirement under PSD2. 3-D Secure is the main method used to request SCA for online card payments, such as when a bank asks a customer to approve a purchase in an app.
Does SCA add a fee to my processing statement?
SCA is an authentication rule, not a standard card-network fee, and the research does not identify a standard SCA statement line or per-transaction charge. Its main business effects are checkout completion, fraud controls, and potential shifts in liability for fraudulent disputes.
Can SCA reduce chargeback liability?
A successfully authenticated 3-D Secure payment generally shifts liability for a fraudulent dispute to the card issuer. Exceptions apply, and an exemption without authentication does not provide the same liability shift.