---
title: "Strong Customer Authentication"
url: "https://mahouse.world/glossary/strong-customer-authentication"
type: "glossary term"
topic: "Regulation"
author: "Ihor Vlasov"
reviewed: "2026-09-20"
published: "2026-08-10"
---

# Strong Customer Authentication

Strong customer authentication is the PSD2 requirement that a customer initiating an electronic payment or accessing a payment account online be verified by two of three independent factors — something they know (a password), something they have (a phone, a card), something they are (a fingerprint, a face) — unless an exemption applies. It made European card-not-present fraud fall and checkout conversion fall with it, and building around it is most of what a European payments company's engineering does.

**Also known as:** SCA, Two-factor authentication for payments, PSD2 SCA

## Key facts

- **Used at:** online card payments, account logins, bank transfers initiated online, and open-banking access — across the EU and (since 2022, with its own rules) the UK
- **Binding:** yes — PSD2 and its regulatory technical standards; issuers must challenge unless an exemption is claimed and accepted; the UK's version is the FCA's, with the same three factors
- **Typical implementation:** 3-D Secure 2 for card payments (the protocol that carries the challenge and the exemption data), banking-app push approvals, one-time codes, biometrics on the phone
- **Typical effect:** at enforcement, challenge rates above 50% and abandonment of 10–25% at the challenge step; card-not-present fraud fell by about a third in the markets that enforced; by 2024 well-run flows challenge under 25% of transactions
- **Parties:** issuers (who challenge), acquirers and merchants (who request exemptions), the schemes (3DS2), the regulators, and the customer, who sees a push notification or nothing

## How strong customer authentication works in practice

A customer pays online. The merchant's gateway sends the transaction to the acquirer, which sends it through 3-D Secure 2 to the issuer with the transaction's data and, if the acquirer qualifies, an exemption request. The issuer's risk engine decides: approve frictionlessly, or challenge. A challenge means the customer's banking app asks her to approve the payment with a fingerprint — two factors, the phone she has and the finger she is — and the payment proceeds. If she does not have the app to hand, or the code does not arrive, she abandons, and that is the cost.

The regulation's logic is liability and fraud. Before SCA, an issuer bore the fraud on a transaction it approved; after, a transaction that passed a challenge is the customer's, and one that was exempted is the exempting party's. Issuers therefore challenge when unsure; acquirers exempt when confident; and the engineering on both sides is about being confident more often — device data, behavioural signals, transaction history, all fed through 3DS2 so the issuer can approve without asking.

For a payments company the metrics are the business: challenge rate, frictionless rate, abandonment at challenge, fraud rate. A buyer reads them beside the take rate.

## Example

A subscription business selling in the EU loses 18% of new sign-ups at the SCA challenge in 2021. Its payments team: moves to 3DS2 with full device data; flags renewals as merchant-initiated (out of scope after the first payment); requests the low-value exemption on trials under €30 and TRA on the rest; offers customers trusted-beneficiary enrolment; and adds a retry with a challenge when an exemption is refused rather than declining. By 2023 the challenge rate on first payments is 19%, abandonment at challenge 9%, overall loss 1.7%. Fraud on exempted transactions is €40,000 a year against €1.1m of recovered subscriptions. The team's dashboard is the first thing a prospective acquirer's payments diligence asks for.

## Common mistakes

- Treating SCA as a compliance checkbox and challenging everything.
- Renewals and merchant-initiated transactions sent through SCA with nobody present to answer.
- One-time codes by SMS as the only second factor, which fails when the phone has no signal and is not "something you have" in the strict reading.
- No retry logic when an issuer refuses an exemption.
- Measuring approval rate and never abandonment at the challenge, where the loss is.

## Related terms

- [SCA Exemption](https://mahouse.world/glossary/sca-exemption.md)
- [3-D Secure 2](https://mahouse.world/glossary/3-d-secure-2.md)
- [PSD2](https://mahouse.world/glossary/psd2.md)
- [Frictionless Flow](https://mahouse.world/glossary/frictionless-flow.md)
- [Identity Verification](https://mahouse.world/glossary/identity-verification.md)
- [Cart Abandonment](https://mahouse.world/glossary/cart-abandonment.md)

— Ihor Vlasov, M&A FinTech Expert. Last reviewed 2026-09-20. https://mahouse.world/authors/ihor-vlasov