SCA - Strong Customer Authentication

What is SCA?

Strong Customer Authentication (SCA) is part of the EU’s revised Payment Services Directive (PSD2), which took effect in 2019. It requires that online payments be authenticated using at least two of three types of factors:

• Something you know: PIN, password, or security questions
• Something you have: cell phone, hardware token, or smart card
• Something you are: Fingerprint, facial recognition, or other biometric data

In practice, this means that when a customer pays online, they typically must authorize the payment via their banking app (something they have) using a fingerprint or facial ID (something they are).

What does SCA mean for your online store?

3D Secure 2 (3DS2)

SCA is technically implemented via 3D Secure 2 (Verified by Visa / Mastercard Identity Check). When a customer pays with a card, they are redirected to an authentication page or authorize the payment in their banking app. 3DS2 is an improvement over the old 3DS1 system and provides a better user experience with fewer friction points.

Liability Shift

An important benefit of SCA/3DS is “liability shift”: When a payment is authenticated via 3D Secure, the liability for fraud shifts from you (the online store owner) to the card issuer (the customer’s bank). This means you do not bear the risk of chargebacks from fraudulent transactions.

Exceptions to SCA

Not all transactions require full SCA. There are several exceptions:

• Transactions under 30 EUR: May be exempt, but the bank may require full SCA after several consecutive exemptions.
• Low-risk transactions: The payment provider can assess the transaction risk and exempt low-risk payments (TRA—Transaction Risk Analysis).
• Subscriptions (MIT): Merchant-Initiated Transactions do not require SCA for subsequent charges after the first authenticated payment.
• Whitelisted stores: Customers can whitelist specific online stores with their bank so that future purchases do not require additional authentication.

Impact on Conversion Rate

SCA adds an extra step to the payment process, which can negatively impact the conversion rate. Estimates vary, but a 5–10% drop-off rate is not uncommon. To minimize the impact:

• Use 3DS2: 3DS2 is far less cumbersome than the old 3DS1. Make sure your payment gateway supports the latest version.
• Take advantage of exemptions: Work with your payment gateway to enable TRA exemptions for low-risk transactions.
• Offer alternative methods: MobilePay and Apple Pay often have a more streamlined authentication process.

SCA and Shoporama

Shoporama’s payment integrations (Stripe, OnPay, QuickPay, DIBS, and others) handle SCA/3D Secure automatically. The gateway redirects the customer to authentication when required and handles fallback in case of technical issues. You don’t need to implement anything yourself—it’s all handled by the payment gateway.