Strong Customer Authentication (SCA): What Online Merchants Need to Know

Strong Customer Authentication (SCA) is an important part of the European payments landscape. It affects how customers authenticate online payments, how payment service providers (PSPs) process transactions, and how merchants manage checkout conversion.

For online merchants, the challenge is to meet applicable authentication requirements without introducing unnecessary friction into the payment process. The choice of PSP or acquirer, the implementation of 3-D Secure, and the availability of authentication exemptions can all influence the customer experience.

This guide explains how SCA works, when authentication may be required, which exemptions may be available, and what merchants should consider when selecting payment providers.

What Is Strong Customer Authentication?

Strong Customer Authentication is a security requirement introduced under the European Union’s Revised Payment Services Directive (PSD2).

Where SCA applies, the payer must authenticate using at least two independent elements from the following categories:

• Knowledge: Something the customer knows, such as a password or PIN.
• Possession: Something the customer possesses, such as a registered mobile device or security token.
• Inherence: Something the customer is, such as a fingerprint or other biometric characteristic.

The elements must be independent, so that compromising one does not undermine the reliability of the other.

SCA is intended to reduce fraud and improve the security of electronic payments. For merchants, however, authentication can introduce additional steps at checkout, potentially affecting conversion rates.

The commercial objective is therefore not simply to minimise authentication. It is to achieve the appropriate balance between regulatory compliance, fraud prevention and a smooth customer experience.

When Does SCA Apply to Online Payments?

SCA requirements apply to certain electronic payment transactions and other actions involving payment accounts under PSD2.

For online merchants, the principal consideration is whether a transaction falls within the applicable regulatory scope and whether an exemption can legitimately be used.

The rules can depend on factors including:

• The location of the payer and the payment service providers involved.
• Whether the customer initiates the payment.
• The type and value of the transaction.
• Whether an applicable exemption is available.
• The authentication and risk-management capabilities of the PSPs involved.

SCA is not simply a requirement that applies to every online payment worldwide. Equally, merchants should not assume that a transaction is outside the rules solely because their business is established outside the European Economic Area (EEA).

Merchants processing payments from European customers should discuss the regulatory scope of their payment flows with their PSP or acquirer, particularly where they use cross-border acquiring arrangements.

What Is the Role of 3-D Secure?

For online card payments, 3-D Secure is a key mechanism used to support cardholder authentication.

The newer 3-D Secure protocols, commonly referred to as 3-D Secure 2 or 3DS2, support richer transaction information and more flexible authentication experiences than earlier implementations.

Depending on the transaction, issuer and payment provider, the process may involve:

• Frictionless authentication: The issuer assesses the transaction using available information and may authenticate it without requiring an additional customer interaction.
• Challenge authentication: The customer is asked to complete an additional authentication step, such as approving a request through a banking application.

The precise outcome depends on the issuer’s assessment, the information supplied, the payment flow and the applicable requirements.

3-D Secure can help merchants meet authentication requirements for card payments, but implementing it does not automatically mean that every transaction will be frictionless or successful.

Merchants should also distinguish between authentication and authorisation. Authentication helps establish that the payer is legitimate; authorisation determines whether the transaction is approved. A successfully authenticated transaction can still be declined.

For a broader discussion of approval performance, see Gropay’s guide to payment authorisation rates and how merchants can improve them.

Which SCA Exemptions May Be Available?

PSD2’s regulatory technical standards provide for several exemptions from SCA. Their availability depends on the transaction and the applicable conditions. The relevant PSPs must support the exemption, and the payer’s PSP may still require authentication or decline the transaction.

Merchants should therefore treat exemptions as tools for managing the payment experience, not as guaranteed ways to bypass authentication.

1. Low-Value Transactions

Certain remote electronic payments of €30 or less may qualify for a low-value exemption.

The exemption is subject to cumulative limits: the total value of qualifying payments since the last application of SCA must not exceed €100, or the number of consecutive payments must not exceed five.

Once the relevant limit is reached, SCA is required unless another applicable exemption is available.

This can be useful for merchants processing frequent, low-value purchases. However, merchants should not assume that every transaction below €30 will automatically be exempt.

2. Transaction Risk Analysis

The transaction risk analysis (TRA) exemption allows a PSP to omit SCA for certain transactions that it identifies as presenting a low level of risk.

Its availability depends on the applicable regulatory conditions, including the PSP’s fraud rates, transaction value and risk assessment.

This can be commercially significant because a capable PSP may be able to support more low-risk transactions without requiring an additional authentication step.

However, the exemption is not simply a merchant-level setting. The relevant PSP must satisfy the regulatory conditions and decide whether to apply it. The issuer may still require authentication.

When comparing PSPs, merchants should ask how transaction risk analysis is supported, how exemption requests are handled, and how often transactions are challenged or declined.

3. Trusted Beneficiaries

Customers may be able to designate a payee as trusted with their payment service provider.

Where the relevant conditions are met, subsequent payments to that trusted beneficiary may qualify for an SCA exemption.

This can be relevant to merchants with repeat customers, although the merchant cannot assume that a customer is on a trusted-beneficiary list or that every subsequent payment will be exempt.

The PSP’s implementation and the customer’s actions determine whether the exemption is available.

4. Recurring Payments and Merchant-Initiated Transactions

Recurring payments require particular care because not every payment described as a subscription is automatically exempt from SCA.

For a series of recurring card payments of the same amount to the same payee, subsequent transactions may qualify for an exemption after the initial transaction has been authenticated, subject to the applicable rules.

Separately, properly structured merchant-initiated transactions (MITs)—for example, certain subsequent payments initiated by the merchant under an agreed arrangement—may fall outside the scope of SCA requirements for payer-initiated transactions.

The distinction matters. A merchant must correctly establish the payment arrangement, identify subsequent transactions and use the appropriate indicators and processing flows.

Merchants should work with their PSP to confirm how initial customer authentication, stored payment credentials, recurring payments and merchant-initiated transactions are handled.

For more detail, see Gropay’s guide to credential-on-file payments.

5. Other Exemptions

The regulatory framework also provides for certain other exemptions, including qualifying secure corporate payment processes and protocols.

Whether an exemption is available depends on the specific circumstances and applicable requirements. Merchants should obtain advice from their PSP rather than assume that a particular business model or payment method automatically qualifies.

How Can SCA Affect Checkout Conversion?

Additional authentication can introduce friction into the checkout process. Customers may abandon a purchase if the authentication process is confusing, takes too long or fails.

However, the effect on conversion is not uniform. It depends on the customer base, issuer behaviour, device, transaction type and the implementation of the payment flow.

Several factors are worth considering.

Authentication Challenges

A challenge introduces an additional customer interaction. If customers cannot complete the process, the payment may fail even when they have sufficient funds and intend to purchase.

Merchants should monitor challenge rates and the outcomes of challenged transactions, rather than looking only at overall payment approval rates.

Frictionless Authentication

Where supported and appropriate, frictionless authentication can help reduce unnecessary customer interaction.

The quality and completeness of the information supplied to the PSP and card issuer can influence the authentication decision. Merchants should discuss with their payment providers whether their integrations support current 3-D Secure capabilities and provide the transaction data needed for effective risk assessment.

Frictionless processing cannot be guaranteed, however, and authentication must still meet applicable requirements.

Payment Authorisation and Declines

Authentication and authorisation are separate stages of the payment process. A transaction can pass authentication but subsequently be declined by the issuer.

Merchants should therefore measure authentication performance alongside authorisation rates, abandonment and fraud. Looking at only one metric can obscure the actual cause of lost revenue.

Customer Experience Across Devices

The authentication experience may differ between desktop browsers, mobile browsers and in-app payments.

Merchants should test the payment journey across their main customer channels and ensure that authentication challenges can be completed without unnecessary technical or usability problems.

How Should Merchants Choose a PSP or Acquirer?

The way a PSP or acquirer implements authentication can influence both the customer experience and payment performance.

When evaluating providers, merchants should consider the following areas.

1. 3-D Secure Support

Confirm that the provider supports appropriate, current 3-D Secure capabilities and can explain how authentication is handled across the merchant’s main payment channels.

Ask how frictionless and challenge flows are supported, and what happens when authentication cannot be completed.

2. Exemption Handling

Ask which SCA exemptions the provider supports and how exemption requests are managed.

In particular, understand how transaction risk analysis is implemented, what conditions affect its availability, and how the provider responds when an issuer requires authentication.

A provider should be able to explain its approach without promising that every eligible-looking transaction will be exempt.

3. Recurring and Stored-Credential Payments

For subscription businesses and merchants with repeat customers, confirm how the provider handles initial authentication, subsequent recurring transactions and merchant-initiated transactions.

Correct implementation can help avoid unnecessary authentication requests and processing problems.

4. Reporting and Optimisation

Merchants should be able to understand how authentication affects their payment performance.

Useful reporting may include:

• Authentication success and failure rates.
• The proportion of transactions subject to a challenge.
• Authorisation rates after authentication.
• Abandonment during checkout.
• Fraud and chargeback performance.
• The performance of recurring and stored-credential transactions.

These metrics help merchants identify whether lost revenue is associated with authentication, issuer declines, integration problems or other factors.

5. Support for the Merchant’s Business Model

Different merchants have different payment requirements. A subscription business, an international retailer and a merchant operating in a higher-risk sector may have very different needs.

The right PSP or acquirer should understand the merchant’s transaction patterns, markets, risk profile and customer experience objectives.

The aim is to find a provider that supports the merchant’s legitimate business requirements while operating within the applicable regulatory framework.

What Should Merchants Do to Prepare?

SCA has been in force for years, so merchants should approach it as an ongoing payment optimisation issue rather than a future regulatory deadline.

The following actions provide a practical starting point.

Review the current payment setup. Confirm how SCA is handled across the merchant’s main payment methods, customer markets and checkout channels.

Analyse authentication performance. Examine challenge rates, authentication failures, payment declines and checkout abandonment. Identify where customers are experiencing unnecessary friction.

Review recurring and stored-credential flows. Confirm that initial authentication, subsequent recurring payments and merchant-initiated transactions are implemented correctly.

Discuss exemptions with the PSP. Establish which exemptions are supported, how eligibility is assessed and what determines whether an exemption request is accepted.

Test the customer journey. Check the payment experience on desktop and mobile, including authentication challenges and unsuccessful payment attempts.

Review performance regularly. Changes in issuer behaviour, fraud patterns, payment integrations and customer behaviour can affect results. Continue monitoring performance and work with the PSP to address problems.

Conclusion

Strong Customer Authentication is an established part of the European payments framework. For online merchants, the ongoing challenge is to meet the applicable requirements while minimising unnecessary friction at checkout.

The choice of PSP or acquirer can influence how authentication, exemption handling, recurring payments and transaction risk analysis are implemented. Merchants should evaluate providers on their ability to support compliant payment flows and deliver strong payment performance—not simply on whether they claim to offer SCA exemptions.

By understanding authentication outcomes, monitoring payment performance and ensuring that stored-credential and recurring-payment flows are correctly configured, merchants can make better-informed decisions about their payment setup.

Gropay helps merchants assess payment providers and payment setups against their commercial requirements. If authentication friction, declining authorisation rates or recurring-payment performance are affecting your business, reviewing your PSP and acquiring arrangements can be a useful starting point.