What is Strong Customer Authentication? SCA and 3-D Secure explained
By SendPay Business · · 2 min read
Strong Customer Authentication, or SCA, is a rule in the UK and Europe that makes people prove it's really them before many online payments and account logins. It came from the EU's second Payment Services Directive (PSD2) and has cut card fraud online.
The two-of-three rule
SCA needs two separate checks from different groups:
- Something you know, like a password or PIN.
- Something you have, like your phone or card.
- Something you are, like a fingerprint or face scan.
How it works for card payments
Online card payments usually meet SCA through 3-D Secure, the step where the customer's bank asks them to approve the payment in their banking app or with a code. Branded as Visa Secure or Mastercard Identity Check, it's run by the card issuer, not the shop.
When it isn't needed
There are exemptions, such as some low-value payments, repeat payments to a business the customer has trusted, and subscriptions after the first payment. Whether one applies is decided by the customer's bank, so businesses should always be ready for the check.
What it means for money apps
Any app that holds customer money or issues cards has to build SCA into its logins, payments and card spending. Choosing a platform and partners that handle it for you saves months of work.
Build it
Create your own financial platform.
Pick a template, name it, brand it, preview every page before you pay. Your brand, your users, your fees.
Build my platform →Questions people ask
What is my card approval rate?
Work out your authorisation rate and what declines cost you.
Authorisation rate calculator →Why do apps check my identity when I sign up?
That's KYC, a separate rule from SCA. The guide explains it.
What is KYC and AML? →What is a chargeback?
When a cardholder's bank reverses a payment. SCA helps prevent fraud-related ones.
What is a chargeback? →What is open banking?
A secure way for apps to connect to bank accounts, also covered by PSD2.
What is open banking? →Read next
This guide is general information, not legal or financial advice. SendPay Business is a technology company, not a bank, and does not take deposits; regulated services on the platforms are provided by licensed partners. PayPal, Patreon and Substack are named as reference points only and are not affiliated with SendPay Business.