Strong Customer Authentication (SCA) Changes

September 3, 2019

All online transactions taking place after the 14th of September 2019 (unless those transactions are exempted) customers will need to provide extra authentication upon checkout.

This is due to new requirements for authenticating online payments being introduced in Europe as part of the Second Payment Services Directive (PSD2). Reference

This extra authentication provided by the customer upon checkout will need to be two of the following:

A password or a PIN

OR

A two factor authentication

OR

A fingerprint or face recognition

If a customer does not meet this authentication upon checkout banks will need to start declining payments that require Strong Customer Authentication (SCA).

What Payments Will be Exempt from SCA?

Payments below €30

Transactions below €30 will be considred "low value" and will be exempt from SCA.

However, if the exemption has been used five times since the cardholder's last successful authentication or if the sum of the previously exempted payments exceeds €100 then SCA will be required.

Fixed-amount subscriptions

When a customer makes a series of recurring payments for the same amount to the same business, SCA will be required for the customer's first payment but subsequent charges will be exempt from SCA.

Low-risk transactions

If a payment provider's or bank's overall fraud rates for card payments do not exceed the below thresholds then the transaction will be exempt from SCA.

0.13% to exempt transactions below €100

OR

0.06% to exempt transactions below €250

OR

0.01% to exempt transactions below €500

Trusted beneficiaries

When completing authentication for a payment, customers may have the option to white list a business they trust to exempt future authentication.

What Does this Mean for UK Customers?

Regardless of the outcome of Brexit, SCA regulation is expected to be enforced in the UK.

However, on the 13th of August 2019, the UK regulator announced an 18 month phase-in period to give banks and businesses more time to prepare for these new requirements.

As a result, it is not expected for banks to fully require SCA payments from UK cards until March 2021. Reference

Need help with your next development project? Let’s talk.

Get in touch