← Payment Reference GuidesAuthentication Reference

Strong Customer Authentication (SCA)

SCA is the PSD2 rule that an electronic payment, or online access to a payment account, must be authenticated with two independent factors — and, for remote payments, bound to the exact amount and payee. This guide covers the whole rule set across channels: the factors and dynamic linking, what is out of scope and every exemption with its thresholds, how SCA runs for cards online and in store and for online and open banking, the UK regime, what PSD3 / PSR change, and similar mandates elsewhere.

What SCA is

Strong Customer Authentication is defined in Article 4(30) of the second Payment Services Directive (PSD2, Directive (EU) 2015/2366): authentication based on two or more elements from the categories knowledge (something only the user knows), possession (something only the user has) and inherence (something the user is), which are independent — the breach of one does not compromise the others — and designed to protect the confidentiality of the authentication data.

The technical detail lives in the Regulatory Technical Standards on SCA and common and secure communication (the "SCA-RTS", Commission Delegated Regulation (EU) 2018/389), drafted by the EBA and applicable since 14 September 2019. The RTS defines the authentication code, dynamic linking, what each element must resist, every exemption with its thresholds, and the open-banking interface rules.

Art. 97(1)(a)

Accessing an account online

Logging in to online or mobile banking, and a third party reading the account through an AISP, both need SCA — subject to the 180-day account-information exemptions.

Art. 97(1)(b)

Initiating an electronic payment

Card payments online and in store, credit transfers from banking apps, and payments initiated through a PISP. Remote payments additionally need dynamic linking to amount and payee (Art. 97(2)).

Art. 97(1)(c)

Any risky remote action

Any action through a remote channel that may imply a risk of payment fraud or other abuse: adding a payee, raising a limit, enrolling a new device, changing the phone number that receives OTPs.

Who applies SCA? Always the payer's PSP — the card issuer or the bank holding the account (the ASPSP). Merchants, acquirers, PSPs and TPPs never "do" SCA themselves (unless the issuer delegates it to them by contract); their job is to enable it — run 3-D Secure, redirect to the bank, carry the result — or to request an exemption the issuer may refuse.

The building blocks at a glance

2 of 3elements from different categories: knowledge, possession, inherence

amount + payeebound to the authentication code for every remote payment (dynamic linking)

≤ 5consecutive failed attempts before the credential is blocked (RTS Art. 4)

5 minmaximum inactivity in an authenticated online-banking session

€30 / €50low-value remote / contactless single-transaction exemption limits

180 daysmaximum interval between SCAs for read-only account access

Timeline

When	What
January 2018	PSD2 applies. Article 97 sets the SCA requirement and leaves the technical detail to EBA standards.
March 2018	The SCA-RTS (Delegated Regulation (EU) 2018/389) is published.
14 September 2019	The RTS applies. The EBA gives national authorities room to let card e-commerce migrate later.
June 2019	EBA Opinion on the elements of SCA: which methods count as knowledge, possession and inherence.
31 December 2020	EBA deadline for SCA on card e-commerce in the EEA; soft-decline enforcement ramps up through early 2021.
14 March 2022	Full SCA enforcement for UK card e-commerce after the FCA's extended migration.
25 July 2023	Delegated Regulation (EU) 2022/2360 applies: a mandatory exemption for account access through an AISP, with SCA renewal every 180 days instead of 90.
19 March 2026	UK removes the fixed contactless limits; firms set their own under a risk-based exemption.
April 2026	EU institutions settle the PSD3 / PSR compromise texts; formal adoption and Official Journal publication are pending, with the PSR expected to apply around 2028.

SCA vs 3-D Secure. SCA is the legal requirement; EMV 3-D Secure is the protocol the card industry uses to meet it online. A 3DS frictionless approval is not SCA — it is the issuer applying an exemption (or treating the transaction as out of scope). Only a challenge, or an authentication the issuer performed through another SCA-compliant method, counts as SCA.

🧩 Check yourself

Can you authenticate and authorize an online payment in the right order?

Expert · shortest route 12 hops · hints included

Put it into practice

Next steps

Tool3DS2 Message Builder & DecoderSketch EMV 3DS (3DS2) AReqs and decode AReq, ARes, CReq/CRes (incl. base64url creq/cres), RReq and Erro messages — transStatus, ECI, reason and error codes explained field by field.Open the tool ToolResponse Code ReferenceSearchable ISO 8583 DE 39 response codes with Visa and Mastercard meanings — Visa decline categories and reattempt limits, plus Mastercard Merchant Advice Codes.Open the tool ToolCAVV CalculatorInspect 3-D Secure CAVV / AAV values: base64 ↔ hex, type by length and leading byte (Visa 20-byte CAVV, Mastercard 21-byte SPA2 AAV) and the ECI values that go with them. Field layouts and scheme algorithms are not public, so no fields are decoded and no CAVV/AAV is generated (the MAC tab is an illustrative TDES CBC-MAC).Open the tool Flow3-D Secure frictionless and challenge flowsSee the animated message flow, step by step, between every party involved.Watch the flow

Keep reading

Authentication3D Secure (EMV 3DS)Authentication flows, message types, ECI values, SCA exemptionsRead article Open BankingOpen Banking & PSD2AISP/PISP roles, consent & SCA flows, FAPI security, UK / Berlin Group / STET, PSD3 & PSRRead article IdentityEUDI Wallet & PaymentseIDAS 2.0 deadlines, the SD-JWT VC / mdoc / OID4VP stack, wallet-based PSD2 SCARead article Card RailsPayment TokenizationFPAN→DPAN lifecycle, VTS vs MDES, TAVV cryptogramsRead article

Common questions

What is Strong Customer Authentication?

SCA is the PSD2 requirement (Article 97, detailed in Delegated Regulation (EU) 2018/389) that a payer is authenticated with at least two independent elements from different categories — knowledge, possession and inherence — when they access a payment account online, initiate an electronic payment, or take a risky action through a remote channel. Remote payments must also be dynamically linked to the amount and payee.

Which transactions are out of scope of SCA?

Merchant-initiated transactions (set up with an authenticated first transaction), mail and telephone orders, one-leg-out transactions where the issuer or acquirer is outside the EEA (best effort), anonymous prepaid cards, and payee-initiated direct debits.

What are the SCA exemptions?

The RTS exempts read-only account information (with SCA every 180 days), contactless payments up to €50 within cumulative limits, unattended transport and parking terminals, trusted beneficiaries, fixed recurring payments, own-account transfers, remote payments up to €30 within cumulative limits, secure corporate payments, and transaction risk analysis up to €500 when the PSP fraud rate is below the reference rate. The issuer can always refuse an exemption.

What is a soft decline?

When an EEA or UK issuer receives a card authorization without SCA and wants SCA, it declines with a code that asks for authentication — 1A at Visa, 65 at Mastercard. The merchant runs 3-D Secure with a challenge and resubmits the authorization with the authentication result.

Is Apple Pay or Google Pay SCA compliant?

Yes. Device wallets combine a device-bound network token and cryptogram (possession) with a biometric or device passcode verified on the phone (inherence or knowledge), which issuers accept as SCA online and in store.