Strong Customer Authentication (SCA)
SCA is the PSD2 rule that an electronic payment, or online access to a payment account, must be authenticated with two independent factors — and, for remote payments, bound to the exact amount and payee. This guide covers the whole rule set across channels: the factors and dynamic linking, what is out of scope and every exemption with its thresholds, how SCA runs for cards online and in store and for online and open banking, the UK regime, what PSD3 / PSR change, and similar mandates elsewhere.
Online card payments: SCA through EMV 3-D Secure
For card-not-present payments the issuer's ACS performs SCA during an EMV 3DS authentication. The merchant's 3DS Server sends the AReq with the device, account and purchase data; the ACS either approves frictionlessly (an exemption or out-of-scope decision on its side) or challenges the cardholder; the result — a CAVV/AAV with an ECI — is then carried into the authorization request, where the issuer verifies it.
Animated flow — the 3DS challenge that delivers SCA
When risk or regulation requires a step-up, the issuer ACS challenges the cardholder directly (OTP, app approval, or biometric) before returning the result.
Checkout
Cardholder confirms payment on the merchant.
The 3DS Server collects device data and initiates authentication.
Asking for an exemption — or a challenge — in the AReq
EMV 3DS 2.2 added SCA-aware values to threeDSRequestorChallengeInd:
| Value | Meaning | Use it for |
|---|---|---|
| 01 / 02 | No preference / no challenge requested | Default traffic; leave the decision to the issuer. |
| 03 | Challenge requested — requestor preference | High-risk orders you want authenticated. |
| 04 | Challenge requested — mandate | Setting up an MIT agreement or card-on-file, and the retry after a soft decline. |
| 05 | No challenge — TRA already performed | Acquirer TRA exemption, requested inside 3DS. |
| 06 | No challenge — data share only | Sending data to the issuer without asking for authentication. |
| 07 | No challenge — SCA already performed | Delegated authentication, where SCA was done elsewhere. |
| 08 | No challenge — use trusted-beneficiary exemption | Merchant already on the cardholder's trusted list. |
| 09 | Challenge requested — trusted-beneficiary prompt | Ask the issuer to offer "trust this merchant" during the challenge. |
On the way back, transStatus tells you the outcome (Y authenticated, C challenge, N / R failed or rejected, A attempted, U unavailable, I informational only — the exemption was acknowledged), and acsChallengeMandated = Y tells you a challenge is required by local regulation such as PSD2. Use the 3DS Message tool to inspect real AReq/ARes pairs.
Two routes to an exemption
Exemption inside 3DS
Send the AReq with challenge indicator 05 or 08. The issuer sees all the 3DS data and may go frictionless — or challenge. One extra round trip, but you have a CAVV and the issuer has the risk data, so approval rates are usually higher.
Straight to authorization
Skip 3DS and put the exemption indicator in the authorization (Visa carries SCA exemption indicators in Field 34; Mastercard uses the Low-Risk Merchant Indicator in DE 48). Fastest checkout, but no liability shift and a higher chance of a soft decline, because the issuer decides with less data.
Soft declines: the issuer wants SCA
- Authorization without SCA (exemption or plain non-3DS) reaches an EEA or UK issuer that wants SCA.
- The issuer answers with a soft decline: 1A at Visa ("additional customer authentication required"), 65 at Mastercard.
- The merchant runs 3DS with challenge indicator 04 while the shopper is still in session.
- The merchant resubmits the authorization with the CAVV / AAV and ECI from that authentication.
Handling the soft decline automatically is the single biggest lever on European approval rates. Never retry a soft-declined transaction unchanged, and never convert it to MOTO or MIT. Look the codes up in the response code tool.
Merchant-initiated transactions
Subscriptions, instalments, top-ups and no-show fees are out of scope only if the agreement was set up correctly:
- Authenticate the first, cardholder-initiated transaction (CIT) — or a zero-amount account verification — with SCA, and state the terms of the agreement.
- Store the network transaction ID the scheme returns (Visa Transaction ID, Mastercard Trace ID) and reference it in every later MIT.
- Flag each later payment as MIT with the right reason (recurring, instalment, unscheduled credential-on-file, delayed charge, no-show). A variable amount is fine for MIT, unlike the RTS recurring exemption.
- Need fresh authentication data without the cardholder (split shipments, adding items)? 3DS 3RI (requestor-initiated) requests can refresh it against the original authentication.
Wallets and delegated authentication
- Apple Pay, Google Pay and other device wallets combine a device-bound network token and cryptogram (possession) with Face ID, fingerprint or device passcode (CDCVM: inherence or knowledge). Issuers accept this as SCA, so wallet payments online and in store do not need a 3DS challenge or a contactless counter reset.
- Card-on-file and click-to-pay credentials are not SCA on their own: a stored token proves the merchant holds a credential, not that the cardholder is present.
- Delegated authentication — the issuer contracts a wallet, PSP or large merchant to perform SCA on its behalf (Visa's Delegated Authentication programme, issuer-wallet agreements). The delegate's authentication counts as the issuer's; liability follows the contract.
- FIDO and Secure Payment Confirmation let an ACS or a delegate run SCA with a passkey, binding amount and payee into the signed assertion.
In store: chip, PIN and contactless counters
Chip & PIN is SCA: the chip's ARQC proves possession of the card, the PIN is knowledge. Contactless without a PIN relies on the Art. 11 exemption, so the issuer has to track the cumulative amount and count since the last SCA:
- Counters on the card — the chip keeps offline cumulative / consecutive counters and asks for online PIN once a limit is hit, via the CVM it requests from the reader.
- Counters at the issuer host — the issuer counts online and, when the limit is reached, soft-declines the contactless authorization (Mastercard 65, Visa 1A).
- Single Tap & PIN — a terminal that supports it prompts for online PIN straight after the soft decline and resubmits, without a second tap. Without it, the cardholder is asked to insert the card.
- A successful chip & PIN transaction, or a wallet tap with CDCVM, resets the counters.
- Unattended transport and parking terminals (Art. 12) need no SCA; other unattended terminals such as vending machines rely on the contactless counters and usually cannot take a PIN, so a soft decline there means a declined sale.
Related tools: CTQ decoder (card CVM requirements) · CVM List decoder · POS entry mode · CAVV calculator
🧩 Check yourself