{"id":3716,"date":"2022-06-23T05:40:03","date_gmt":"2022-06-23T05:40:03","guid":{"rendered":"https:\/\/ccbill.com\/kb\/?p=3716"},"modified":"2023-03-07T12:21:11","modified_gmt":"2023-03-07T12:21:11","slug":"strong-customer-authentication","status":"publish","type":"post","link":"https:\/\/ccbill.com\/kb\/strong-customer-authentication","title":{"rendered":"What Is SCA? Strong Customer Authentication Explained"},"content":{"rendered":"

Introduction<\/p>\n\n\n

The introduction of security protocols and procedures in online payment processing<\/a> was a major step forward in payment security<\/a>. However, as beneficial as they are for the protection of financial assets and payment information, these protocols started causing friction in the user experience (UX).<\/p>\n\n\n\n

In 2019, the European Union launched the Revised Directive on Payment Services (PSD2)<\/a> which includes a payment authentication method that involves less friction. This method is known as strong customer authentication.<\/p>\n\n\n\n

Find out how strong customer authentication works and how to use it to prevent payment fraud<\/a>.<\/p>\n\n\n\n

\"What<\/figure>\n\n\n\n

What is Strong Customer Authentication (SCA)?<\/h2>\n\n\n\n

Strong customer authentication (SCA) is a requirement introduced with the Revised Directive on Payment Services<\/a> that imposes the use of multi-factor authentication on financial institutions in the European Economic Area.<\/p>\n\n\n\n

Multi-factor authentication aims to ensure that only the true cardholder can use their credit or debit card.<\/p>\n\n\n\n

Strong authentication requires cardholders to verify their identity by providing two of the following three identifiers:<\/p>\n\n\n\n

    \n
  1. Something they own (a mobile phone or ID token).<\/li>\n\n\n\n
  2. Something they know (PIN, password, scheme).<\/li>\n\n\n\n
  3. Something that is part of them (fingerprint or facial recognition).<\/li>\n<\/ol>\n\n\n\n
    \"Two<\/figure>\n\n\n\n

    When Is Strong Customer Authentication Used?<\/h2>\n\n\n\n

    Strong customer authentication is used in the following three situations:<\/p>\n\n\n\n

      \n
    1. Accessing an online payment account <\/strong>(the login process on a bank\u2019s website or mobile application).<\/li>\n\n\n\n
    2. Initiating a payment<\/strong> (face-to-face or online payments, also known as card-not-present transactions<\/a>).<\/li>\n\n\n\n
    3. Using a remote channel to perform actions that are considered a payment fraud risk <\/strong>(saving payment information on a website or in an app).<\/li>\n<\/ol>\n\n\n\n

      How to Achieve and Maintain SCA Compliance?<\/h2>\n\n\n\n

      To become SCA compliant, businesses must:<\/p>\n\n\n\n

        \n
      1. Check whether SCA applies to them. SCA is applicable when the business\u2019s and a customer\u2019s banks are based in the European Economic Area.<\/li>\n\n\n\n
      2. Determine whether their business model<\/a> and transactions require SCA.<\/li>\n\n\n\n
      3. Ensure their integration supports 3DS.<\/li>\n<\/ol>\n\n\n\n

        To maintain SCA compliance, businesses must keep up with any changes in or newer versions of the Payment Service Directive and communicate with their payment service providers<\/a>.<\/p>\n\n\n\n

        SCA Timeline<\/h2>\n\n\n\n

        Strong customer authentication was to be in full effect by January 1st, 2021. However, due to the pandemic, the number of ecommerce transactions under SCA rose dramatically. That made legislators postpone the enforcement of SCA further into 2021.<\/p>\n\n\n\n