Strong customer authentication, or SCA, is a payment-security requirement that authenticates a payer using independent elements from recognized categories such as knowledge, possession and inherence. The exact legal scope, exemptions and evidence depend on the applicable jurisdiction, payment method and transaction.
What does independent authentication mean?
Compromise of one element should not undermine the reliability of another. Examples may include a password, possession of a registered device and a biometric characteristic, subject to the relevant technical rules.
When can SCA apply?
It may apply when a payer accesses an account, initiates an electronic payment or performs an action carrying fraud risk in a covered market. Providers determine treatment based on transaction data and applicable rules.
What are exemptions and exclusions?
Some transactions may qualify for an exemption or fall outside scope, but this is not the same as ignoring authentication. The provider should record the basis and may still request a challenge.
How does SCA affect checkout?
A transaction may proceed without visible interaction, trigger an authentication challenge or fail when required data is missing. Clear status handling and return paths prevent the payer from submitting duplicates.
What should be recorded?
Keep the authentication request, result, method, exemption or scope basis, provider reference, transaction linkage and final payment outcome. Authentication does not prove settlement.
