This guide explains strong customer authentication (SCA) under the PSD2 regulation, covering authentication factors, key exemptions, and electronic payment security. It details how card payment authentication functions and how implementing a compliant card programme protects transactions for modern e-commerce merchants.
Secure electronic payments protect modern commerce, shielding commercial entities and consumers from financial crime. Strong customer authentication (SCA) is the primary mechanism for confirming identities during online card payments and is a core standard of the Second Payment Services Directive (PSD2). By demanding multiple verification layers, this rule forms the foundation of modern payment authentication, making digital transactions safer for businesses and buyers alike.
What is strong customer authentication (SCA)?
SCA is a regulatory safety standard in the European Economic Area (EEA) and the UK requiring payment service providers to perform multi-factor verification on digital transactions.
Under the Payment Services Directive (PSD2), payment service providers must verify at least two independent factors before approving electronic payments. This protocol protects transactions by verifying that the person initiating a payment is the actual cardholder, curbing online financial crime. Verification draws from three categories: knowledge, possession, and inherence. If an unauthorised third party intercepts one factor, the other remains secure, preventing unauthorised transfers.
| Factor | Description | Example |
| Knowledge | Something the user alone knows | Password or PIN |
| Possession | Something the user alone owns | Mobile phone or token |
| Inherence | Something the user biologically is | Fingerprint scan |
Q&A: Is two-factor authentication always required under SCA?
Two-factor verification is mandatory for payer-initiated electronic payments in Europe. However, specific low-value transactions, recurring payments, and low-risk sales can bypass these checks using regulatory exemptions approved by the cardholder’s payment service provider, maintaining swift and secure transaction flows.
When does SCA apply, and which exemptions exist?
SCA applies to payer-initiated electronic payments within the European Economic Area and the United Kingdom, though transactions meeting specific criteria can claim exemptions to bypass multi-factor checks.
Card payment authentication is required when a buyer accesses an online payment account or initiates an electronic transaction. To maintain a convenient payment process, PSD2 SCA rules define specific SCA exemptions that allow card issuers and acquirers to bypass multiple checks. When a transaction qualifies, the provider can skip the secondary step, creating a frictionless path for the user.
- Low-value transactions: Payments under €30 are exempt, provided cumulative exempt payments do not exceed €100.
- Transaction risk analysis (TRA): Processors can skip SCA if real-time monitoring shows risk is below regulatory thresholds.
- Recurring transactions: For subscription payments, only the first transaction requires full SCA; subsequent payments remain exempt.
- Trusted beneficiaries: Customers can add merchants to a whitelist, allowing future purchases to bypass checks.
- Corporate payment systems: Payments processed through corporate systems, such as virtual cards, are exempt from authentication.
UK Finance Annual Fraud Report 2026 data shows that financial institutions prevented £1.68 billion in unauthorised fraud attempts during 2025. This high volume highlights why structured verification rules remain a necessary safeguard for commercial transactions.
Q&A: Can every online payment qualify for an exemption?
No payment is guaranteed to skip verification. Even if a transaction fits an exemption category, the card issuer holds final authority and can demand full authentication if they detect unusual spending patterns or suspicious login indicators on the account during the transaction.
How does 3D Secure support SCA compliance?
3D Secure is the primary technology protocol that card networks use to execute strong customer authentication and exchange verification data between merchants and card issuers.
In online payment security, EMV 3-D Secure serves as the communication protocol. It allows the acquirer and issuer to share rich data points about each electronic payment, verifying the identity of the cardholder before final approval.
The system supports frictionless authentication and challenge flows. When a merchant submits a payment, the 3DS engine evaluates risk parameters like device IDs. If the risk is low, the payment goes through frictionless authentication, requiring no manual action. Risky transactions enter the challenge flow, where customers provide a password, input an SMS code, or use biometrics to complete verification.
| Flow | Customer action | Expected outcome |
| Frictionless | No extra verification steps required | Instant transaction approval |
| Challenge | Enters code or performs biometric check | Approval upon verification |
| Out-of-band | Approves via a separate mobile app | Secure validation outside the merchant |
This technology connects stakeholders in the payment cycle. Standardisation guarantees that banks can implement their preferred verification methods, whether they use dedicated apps, hardware devices, or physical readers, preventing payment disruptions.
Q&A: Does 3D Secure eliminate merchant liability for fraud?
When a transaction completes the 3D Secure flow, the liability for fraudulent chargebacks moves from the merchant to the cardholder’s bank. This protection applies even if the customer bypasses active verification through a frictionless flow approved by the card issuer during checkout.
How does Wallester White-Label support strong customer authentication?
Wallester White-Label provides a fully compliant card issuing platform with built-in 3D Secure capabilities, allowing businesses to launch custom card programmes with automated regulatory adherence.
Setting up secure payment infrastructure requires a card management platform that integrates with regulatory standards. Wallester White-Label offers a comprehensive Visa card programme infrastructure, handling the complexities of issuer-side authentication so businesses can focus on user experience.
The system includes direct API integration for seamless communication with card management systems. Businesses can deploy physical and virtual cards with configurable controls to set transaction limits, restrict spending, and monitor activities. Through built-in 3D Secure support, Wallester White-Label executes issuer-side authentication, supporting tokenisation and modern verification.
Businesses planning to launch their own payment card programme can explore how Wallester White-Label supports PSD2-compliant authentication, secure card transactions, and modern payment infrastructure.
