strong customer authentication (SCA)
Strong customer authentication (SCA) is the requirement under the UK Payment Services Regulations 2017 that a payer initiating an electronic payment, or accessing their account online, be authenticated using at least two independent factors: something they know, something they have or something they are. The FCA supervises it.
SCA has applied in the UK since 14 September 2019, with online card payments brought fully into line in March 2022 after a phased plan the FCA agreed with the industry. It applies whenever a payer initiates an electronic payment, accesses a payment account online or carries out a remote action that could carry fraud risk, unless an exemption applies. The factors have to be independent, so a password and a code sent to the same device may not count. For online card payments the mechanism is almost always 3-D Secure, with the challenge delivered through the cardholder's banking app.
Why it matters to a business: SCA is the reason some payments ask the customer to confirm in their bank app and some do not. Low-value payments, low-risk payments under transaction risk analysis, trusted beneficiaries and recurring payments of a fixed amount can be exempted. Merchant-initiated transactions against a card the customer saved after an authenticated first payment are outside SCA altogether, which is what makes card-on-file billing work.
For a software platform the watch point is who claims the exemptions. The regulated acquiring partner decides which it supports; the platform's checkout has to pass the right flags. Get it wrong and the issuer soft-declines the payment asking for authentication, which looks to the customer like a failed card.
Sources
- FCA, Strong customer authentication, 17 February 2023
- The Payment Services Regulations 2017, regulation 100 (authentication), 19 July 2017