Payments
Strong Customer Authentication (SCA)
Definition
A requirement that online account access and electronic payments be authenticated using at least two independent factors from knowledge, possession and inherence. It applies in the European Economic Area under PSD2 and in the United Kingdom under equivalent rules.
Key takeaways
- SCA requires two independent factors from knowledge, possession and inherence.
- In card payments it is implemented mainly through the 3D Secure protocol.
- Every authentication step costs some deposit conversion, so success rates are monitored as closely as chargebacks.
- Exemptions exist for low-value and trusted-beneficiary payments, and claiming them correctly is a payment-orchestration task.
Why it matters
Strong customer authentication requires two of three independent factor types: something the customer knows such as a password, something they possess such as a registered device, and something they are such as a biometric. Independence is the operative word, because two factors delivered through the same compromised channel provide no additional assurance. In card payments the requirement is implemented largely through the 3D Secure protocol, which is why the checkout experience changed noticeably when the rules took effect.
For gambling operators the effect is a direct trade-off between fraud reduction and conversion. Every additional authentication step loses some proportion of deposits, and a failed or timed-out challenge is a deposit that does not arrive, so payment teams monitor authentication success rates as closely as chargeback rates. The rules do provide for exemptions, including low-value transactions and trusted-beneficiary arrangements, and building the logic to claim them correctly is a meaningful part of payment orchestration work. The wider point is that authentication friction is now a competitive variable: two operators on the same acquiring setup can see materially different deposit success rates depending on how well their flows are configured.
Sources
- Directive (EU) 2015/2366 on payment services in the internal market (PSD2) - EUR-Lex
- Strong Customer Authentication - Financial Conduct Authority
Frequently asked questions
What counts as a strong authentication factor?
Something the customer knows, such as a password; something they possess, such as a registered phone; or something they are, such as a fingerprint. Two of the three are required, and they must be independent of each other.
How does SCA affect deposit conversion?
It reduces it. Each additional step loses some customers to abandonment or timeout, which is why authentication success rate is a core payments metric for gambling operators.
Are there exemptions from SCA?
Yes, including low-value transactions and trusted-beneficiary arrangements. Applying them correctly requires logic in the payment stack, and misapplied exemptions are declined.