Strong Customer Authentication
Also known as: SCA, PSD2 SCA, Strong Authentication
EU regulation (PSD2) requiring two-of-three authentication factors for most electronic payments, primarily enforced through 3D Secure 2.
Definition
Strong Customer Authentication (SCA) is a requirement under the European Union's Second Payment Services Directive (PSD2) that mandates two out of three authentication factors on most electronic payments: something the customer knows (password, PIN), something the customer has (phone, hardware token), and something the customer is (fingerprint, face scan).
In practice, SCA is enforced through 3D Secure 2 (3DS2) — when a customer pays with a card on a European-issued bank, the issuer can challenge the transaction with a step-up authentication flow on the customer's banking app or via SMS code. Modern payment gateways handle this automatically; the merchant just sees an extra redirect or modal during checkout.
SCA includes exemptions for low-value transactions, recurring fixed-amount subscriptions, merchant-initiated transactions (with stored credentials), and trusted-beneficiary lists. Subscription-billing systems typically use the merchant-initiated transaction exemption to charge recurring invoices without requiring re-authentication every cycle.
Why It Matters
If your billing stack doesn't handle SCA correctly, you'll see European card declines spike to 30-40% on initial transactions and unexpected failures on recurring charges. The decline reason is usually 'authentication required' and the fix is to route the initial payment through a 3DS2 challenge flow.
The biggest mistake is treating SCA as something only large enterprises need to worry about. As of 2021, European acquirers are fully enforcing it. Any merchant taking EU cards without 3DS2 support is losing 1 in 3 transactions to authentication declines, often without realizing it.
Examples in Practice
A SaaS company processing $50K/mo through Stripe sees their EU decline rate jump from 8% to 28% after PSD2 enforcement begins. Switching the integration to use Stripe's Payment Intents API with automatic 3DS2 handling drops the decline rate back to 9% within a week.
A subscription business correctly authenticates the first charge through 3DS2 but stores the payment credential as a merchant-initiated transaction (MIT) for future recurring charges. Subsequent monthly charges process without challenges because they qualify for the MIT exemption.
An e-commerce checkout for a $5 micro-transaction skips the 3DS2 challenge under the low-value-transaction exemption (charges under €30 with a cumulative limit per card). The customer experience stays one-click; the bank still authorizes.