SCA and 3D Secure: what they mean for your online store

The European Payment Services Directive (PSD2) requires strong customer authentication (SCA) for electronic payments: the cardholder must prove their identity with two of these three factors: something they know (PIN, password), something they have (their phone) and something they are (fingerprint, face).

3D Secure 2

For card payments, SCA is applied through 3D Secure 2: the customer’s bank decides, based on risk, whether to ask for confirmation (usually in the bank’s app) or let the payment through without friction. Version 2 sends far more information about the transaction than the old one, which is why many payments are approved without the customer having to do anything.

Exemptions

• Low amounts: below €30, with cumulative limits.
• Transaction risk analysis by the bank or the gateway.
• Trusted beneficiaries that the customer has whitelisted with their bank.
• Merchant-initiated transactions (MIT): recurring or deferred charges that the customer previously authorised with SCA.

Recurring payments and subscriptions

The first payment of a subscription is made by the customer with authentication. Subsequent ones are initiated by the merchant without the customer present, flagged as MIT and linked to that first payment. If the gateway or the module does not flag them correctly, the bank may request authentication on a renewal and the charge fails.

Less friction

• Gateways with embedded forms that show the authentication step without leaving the store.
• Alternative methods that already include authentication: Bizum, Apple Pay, Google Pay.
• Clear messages during payment: “Your bank may ask you to confirm the payment in its app”.