Strong Customer Authentication (SCA)

SCA requires at least two of three factors: - Something the user knows (password or PIN) - Something the user has (phone or token) - Something the user is (biometrics)

SCA applies to most electronic payments within the European Economic Area. However, exemptions include low-value payments, recurring transactions, and trusted beneficiaries—though these still require dynamic risk assessment by the payment processor.

Merchants face increased cart abandonment due to added friction. Some banks’ inconsistent SCA implementations also cause failed transactions. Additionally, exempting too many transactions may lead to higher fraud rates, defeating the regulation’s intent.