Strong customer authentication (SCA)
DEFINITION
Strong customer authentication (SCA) is a PSD2 regulatory requirement mandating that electronic payment authentication use at least two of three independent factors: something the customer knows, has, and is.
TABLE OF CONTENTS
RELATED TERMS
Strong customer authentication (SCA) is a regulatory requirement, introduced under the EU's revised Payment Services Directive (PSD2), that requires electronic payment authentication to use at least two of three independent factors: something the customer knows, such as a password or PIN; something the customer has, such as a phone or hardware token; and something the customer is, such as a fingerprint or face scan. The requirement applies primarily to electronic payments within the European Economic Area, and the UK has its own equivalent requirement.
For subscription businesses, SCA is not only a checkout-time concern. Renewal payments can also be subject to authentication requirements, though card networks and regulators provide exemptions for certain recurring or previously authenticated transactions so that not every renewal requires a fresh challenge. Common exemptions include low-value transactions under EUR 30, merchant-initiated recurring transactions following an initial authenticated payment, and phone or mail-order transactions, though the card issuer always has final say and can still require authentication. A payment platform such as Recurly can help apply SCA correctly on both the initial transaction and subsequent renewals, and can apply available exemptions where eligible to reduce customer friction. Recurly automatically flags eligible renewals as merchant-initiated and flags Admin Console transactions as exempt phone or mail orders, and falls back to a 3DS dunning flow to re-authenticate a customer if an issuer rejects an exemption and requires a challenge anyway.
Why strong customer authentication matters for subscription businesses
SCA matters because failing to apply it where required can cause the issuing bank to decline the transaction outright. For a subscription business, that risk does not end after the first sale. Every renewal payment carries the same authentication requirement unless a valid exemption applies, so incorrect handling of SCA can show up as an elevated rate of failed renewal payments rather than a one-time checkout problem. Getting SCA and its exemptions right is therefore tied directly to recurring revenue: a business that over-applies authentication challenges risks unnecessary checkout and renewal friction, while a business that under-applies it risks declines and potential liability for fraud that a properly authenticated transaction would have avoided.
How strong customer authentication works
The customer initiates a payment, either at checkout or as part of a recurring renewal.
The payment provider or issuing bank determines whether SCA is required for that transaction, based on its type, value, and any applicable exemption.
If SCA is required, the customer completes an additional authentication step, commonly through 3D Secure, using two of the three factors: knowledge, possession, or inherence.
If a valid exemption applies, such as a low-value transaction, a recurring merchant-initiated transaction building on a previously authenticated payment, or a transaction cleared through the provider's transaction risk analysis, the payment can proceed without a fresh authentication challenge.
The transaction is authorized or declined based on the outcome of authentication or the applicable exemption.
Strong customer authentication vs 3D Secure
Strong customer authentication is the regulatory requirement. 3D Secure is the technical protocol most widely used to satisfy that requirement for card payments. In practice, when a customer sees a one-time passcode, a biometric prompt, or a banking-app approval step during checkout, that step is usually 3D Secure fulfilling the SCA mandate. SCA does not require 3D Secure specifically, but 3D Secure is the dominant mechanism because it is supported broadly across card networks and issuing banks and because, when correctly applied, it can shift fraud liability for a disputed transaction from the merchant to the card issuer.
Benefits and examples
Reduced fraud: requiring two independent authentication factors makes card-not-present fraud much harder to carry out than a single factor, such as a card number alone.
Liability shift: correctly applying SCA through 3D Secure can shift liability for certain fraudulent transactions from the merchant to the card issuer.
Increased consumer trust: visible authentication steps, such as a biometric prompt or bank-app approval, reinforce to customers that their payment is being protected.
Preserved renewal continuity: correctly applying available exemptions on recurring transactions avoids adding unnecessary friction or authentication prompts to a renewal a customer has already approved once.
Common mistakes with strong customer authentication
Applying an authentication challenge to every transaction, including eligible recurring renewals, which increases friction and can raise cart or checkout abandonment.
Failing to apply SCA where it is actually required, which can result in the issuing bank declining the transaction.
Misclassifying an exemption, such as treating a transaction as low risk when it does not qualify, which can lead to unnecessary declines.
Not accounting for regional differences, since SCA requirements and exemption rules differ depending on where the cardholder's bank is regulated.
Frequently asked questions
What are the three authentication factors used in SCA? Something the customer knows, such as a password or PIN; something the customer has, such as a phone or hardware token; and something the customer is, such as a fingerprint or facial scan. SCA requires at least two of these three factors.
Does SCA apply to every payment? No. Card networks and regulators provide exemptions for certain transaction types, including some low-value payments, recurring merchant-initiated transactions building on a previously authenticated payment, and transactions cleared through a provider's transaction risk analysis.
Is SCA the same as 3D Secure? No. SCA is the regulatory requirement. 3D Secure is the most common technical protocol used to satisfy that requirement for card payments.
What happens if a transaction that requires SCA is not authenticated? The issuing bank can decline the transaction. For a subscription business, this can appear as an elevated rate of failed renewal payments if SCA is not correctly applied.
Does SCA only apply in the European Union? SCA originates from EU regulation (PSD2), and the UK maintains its own equivalent requirement. Businesses operating in other regions should confirm the specific authentication requirements that apply where their customers' card issuers are regulated.
