Strong customer authentication (SCA)
Also called SCA, PSD2 SCA.
The EU rule under PSD2 that online payments and account access must be confirmed with two independent factors from different categories.
Last updated
What it is.
PSD2 Article 4(30) defines SCA as authentication using two or more independent elements from knowledge (something only the user knows), possession (something only the user has) and inherence (something the user is). Article 97 requires it when a payer accesses their account online, starts an electronic payment, or does anything remotely that may carry a risk of fraud.
Delegated Regulation (EU) 2018/389 sets the technical standards and the exemptions. For example, remote payments of up to EUR 30 can be exempt, as long as the running total since the last SCA stays at or below EUR 100 or there have been no more than five such payments in a row.
Why it matters
SCA changes checkout and login flows for any product serving EU payers. Done badly it adds friction and abandoned payments. Done well it uses exemptions and smooth methods, such as app-based approval or biometrics, so most users barely notice.
In a product build
In a payments build, SCA is mostly handled by the payment provider's flow, but the product still needs screens for the challenge, clear errors and retries when authentication fails.
Common mistakes.
- 01
Using two factors from the same category, such as a password and a security question.
- 02
Not handling the challenge step, so payments fail silently.
- 03
Assuming exemptions always apply. The payer's bank can still ask for SCA.
Read the official text.
Primary sources this definition is based on.
- Directive (EU) 2015/2366, PSD2 (Official Journal)checked 2026-10-25
- Delegated Regulation (EU) 2018/389, standards for strong customer authenticationchecked 2026-10-25
Work it out with a tool.
Related terms.
- Open bankingLetting customers give licensed third-party apps access to their bank account data, or let them start payments, through secure bank APIs.
- Tokenization (payments)Replacing a card number or other sensitive value with a stand-in token that cannot be turned back into the original without the token service.
- ChargebackA forced reversal of a card payment, started by the cardholder's bank after the cardholder disputes the charge.
- Encryption in transitEncrypting data while it moves between systems, usually with TLS, so it cannot be read or changed on the way.
