Strong customer authentication
Also known as: SCA
Strong customer authentication is the PSD2 requirement to verify a payer using two or more independent elements from knowledge (something you know), possession (something you have) and inherence (something you are), so that breaching one does not compromise the others.
Last reviewed
Example
A banking app asks for your fingerprint (inherence) on a phone that was registered to you (possession) to approve an online payment.
A password is one thing. A password and a code sent to the phone in your pocket is two. Strong customer authentication is the law saying two is the minimum.
The definition
PSD2 defines SCA as authentication based on the use of two or more elements, each from a different category:
- Knowledge: something only the user knows, such as a PIN or password.
- Possession: something only the user has, such as a registered phone.
- Inherence: something the user is, such as a fingerprint or face.
The elements must also be independent, "in that the breach of one does not compromise the reliability of the others", as the EBA puts it.
Two passwords do not qualify. Both are knowledge.
When it applies
SCA applies when a payer starts an electronic payment or accesses a payment account online, with exemptions set out in the technical standard, Delegated Regulation (EU) 2018/389. The requirement legally applied from 14 September 2019. For e-commerce card payments, the EBA gave the industry until 31 December 2020 to complete the migration.
The exemptions are where most of the practical questions live. Low-value contactless payments are one of them. Others cover things like low-risk transactions and trusted beneficiaries, and each has conditions that the provider has to meet.
How it shows up
For a card payment online, the bank usually runs SCA through 3-D Secure. In a shop, chip and PIN already combines possession of the card with knowledge of the PIN. A tap on a phone wallet combines the phone with a biometric or passcode.
For a merchant, the most useful point is who is responsible. The issuer applies SCA to the payer. The merchant and acquirer make sure the payment carries what the issuer needs to decide.
Strong does not mean slow. It means the check cannot be passed by a single stolen secret.