SCA - Strong Customer Authentication

What is SCA?

Strong Customer Authentication (SCA) is part of the EU's revised Payment Services Directive (PSD2), which came into force in 2019. It requires online payments to be authenticated with at least two of three factor types:

• Something you know: PIN, password or security question
• Something you have: Mobile phone, hardware token or smartcard
• Something you are: Fingerprint, facial recognition or other biometrics

In practice, this means that when a customer pays online, they typically have to authorize the payment via their banking app (something they have) with fingerprint or face ID (something they are).

What does SCA mean for your online store?

3D Secure 2 (3DS2)

SCA is technically implemented via 3D Secure 2 (Verified by Visa / Mastercard Identity Check). When a customer pays by card, they are sent to an authentication page or authorize in their banking app. 3DS2 is an improvement on the old 3DS1 system and provides a better user experience with fewer friction points.

Liability shift

A key benefit of SCA/3DS is liability shift: when a payment is authenticated via 3D Secure, the liability for fraud shifts from you (the webshop owner) to the card issuer (the customer's bank). This means that you do not bear the risk of chargebacks from fraudulent transactions.

Exceptions to the SCA

Not all transactions require full SCA. There are several exceptions:

• Transactions under 30 EUR: Can be exempted, but the bank may require it after several consecutive exemptions.
• Low risk transactions: The payment provider can assess the transaction risk and exempt low risk payments (TRA - Transaction Risk Analysis).
• Subscriptions (MIT): Merchant-Initiated Transactions after the first authenticated payment do not require SCA for subsequent charges.
• Whitelisted stores: Customers can whitelist specific webshops in their bank so that future purchases do not require additional authentication.

Effect on conversion rate

SCA adds an extra step in the checkout process, which can negatively impact conversion rates. Estimates vary, but 5-10% drop-off is not uncommon. To minimize the effect:

• Use 3DS2: 3DS2 is far more frictionless than the old 3DS1. Make sure your gateway supports the latest version.
• Take advantage of exceptions: Work with your payment gateway to enable TRA exceptions for low-risk transactions.
• Offer alternative methods: MobilePay and Apple Pay often have a more streamlined authentication process.

SCA and Shoporama

Shoporama's payment integrations (Stripe, OnPay, QuickPay, DIBS, etc.) handle SCA/3D Secure automatically. The gateway sends the customer for authentication when required and handles fallback in case of technical issues. You don't need to implement anything yourself - it's all handled by the payment gateway.