Strong Customer AuthenticationSCA

A European rule requiring two separate proofs of identity, not just a password, to complete most online payments.

For example, a shopper might enter a card number and then approve the payment with a fingerprint in their banking app, which gives the bank two independent proofs.

A PSD2 mandate requiring at least two independent authentication factors, something the customer knows, has, or is, before authorizing an electronic payment, functionally Europe's regulatory version of multi-factor authentication. PSD2 is the European Union's revised Payment Services Directive.

The three kinds of factor are:

• Something the customer knows, such as a password or personal identification number (PIN).
• Something the customer has, such as a phone or a card reader.
• Something the customer is, such as a fingerprint or face scan.

Some payments can skip the full check under exemptions. Common categories include:

• Low-value payments, which fall under a small amount.
• Low-risk payments, which the provider can justify through transaction risk analysis.
• Merchant-initiated payments, such as a subscription charge the customer already agreed to.
• Trusted beneficiaries, which are payees the customer has approved in advance.

Strong Customer Authentication sits next to terms that are easy to mix up:

• Multi-factor authentication (MFA) is the general security practice, and SCA is the regulatory requirement for payments.
• 3-D Secure is the card protocol that merchants and banks commonly use to deliver SCA online.
• PSD2 is the directive that created the requirement.