{"head":{"title":"What Is Strong Customer Authentication (SCA)? | OceanLab","description":"SCA is the PSD2 rule that EU payments and account access need two independent proofs of identity. The three factors, key exemptions and common mistakes.","canonical":"https://oceanlab.in/glossary/strong-customer-authentication"},"crumbs":[{"name":"Home","path":"/"},{"name":"Glossary","path":"/glossary"},{"name":"strong customer authentication","path":"/glossary/strong-customer-authentication"}],"slug":"strong-customer-authentication","term":"Strong customer authentication (SCA)","aka":["SCA","PSD2 SCA"],"category":"Payments and fintech","short":"The EU rule under PSD2 that online payments and account access must be confirmed with two independent factors from different categories.","body":[["PSD2 Article 4(30) defines SCA as authentication using two or more independent elements from knowledge (something only the user knows), possession (something only the user has) and inherence (something the user is). Article 97 requires it when a payer accesses their account online, starts an electronic payment, or does anything remotely that may carry a risk of fraud."],["Delegated Regulation (EU) 2018/389 sets the technical standards and the exemptions. For example, remote payments of up to EUR 30 can be exempt, as long as the running total since the last SCA stays at or below EUR 100 or there have been no more than five such payments in a row."]],"why":["SCA changes checkout and login flows for any product serving EU payers. Done badly it adds friction and abandoned payments. Done well it uses exemptions and smooth methods, such as app-based approval or biometrics, so most users barely notice."],"example":["A coffee ordering app in the EU sends small card payments of around EUR 5. The payer's bank may skip SCA under the low-value exemption, but after five such payments in a row, or once they add up to more than EUR 100, it asks for SCA again. The app has to handle that challenge at checkout."],"inBuild":["In a payments build, SCA is mostly handled by the payment provider's flow, but the product still needs screens for the challenge, clear errors and retries when authentication fails."],"mistakes":[["Using two factors from the same category, such as a password and a security question."],["Not handling the challenge step, so payments fail silently."],["Assuming exemptions always apply. The payer's bank can still ask for SCA."]],"related":[{"href":"/glossary/open-banking","label":"Open banking","detail":"Letting customers give licensed third-party apps access to their bank account data, or let them start payments, through secure bank APIs."},{"href":"/glossary/tokenization","label":"Tokenization (payments)","detail":"Replacing a card number or other sensitive value with a stand-in token that cannot be turned back into the original without the token service."},{"href":"/glossary/chargeback","label":"Chargeback","detail":"A forced reversal of a card payment, started by the cardholder's bank after the cardholder disputes the charge."},{"href":"/glossary/encryption-in-transit","label":"Encryption in transit","detail":"Encrypting data while it moves between systems, usually with TLS, so it cannot be read or changed on the way."}],"tools":[{"href":"/tools/fintech-app-cost","label":"Fintech app cost","detail":"Free tool"},{"href":"/tools/payment-processing-fee-calculator","label":"Payment processing fee calculator","detail":"Free tool"}],"links":[{"href":"/compliance/psd2","label":"PSD2 guide","detail":"EU payment rules, open banking and SCA."},{"href":"/build/payment-gateway","label":"Building a payment gateway","detail":"Card flows, tokens and PCI scope."},{"href":"/software/payments","label":"Software for payments","detail":"Payment systems and the compliance work they bring."}],"sources":[{"title":"Directive (EU) 2015/2366, PSD2 (Official Journal)","url":"https://eur-lex.europa.eu/eli/dir/2015/2366/oj","checkedAt":"2026-10-25"},{"title":"Delegated Regulation (EU) 2018/389, standards for strong customer authentication","url":"https://eur-lex.europa.eu/eli/reg_del/2018/389/oj","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}