Strong customer authentication
What is strong customer authentication?
Strong customer authentication (SCA) is a rule under the EU’s revised Payment Services Directive (PSD2), requiring you to prove it’s you in at least two different ways before making an electronic payment. It’s there to keep fraudsters from taking control of payments you make online or through an app. If you’d like more detail, you can find it in our guide to PSD2 and your payment rights.
There are three broad types of proof: something you know (like a password, a code from a payslip, or a PIN); something only you have (your phone, a physical security key, or a banking token); and something you are (such as a fingerprint or your face). To meet SCA, the system always asks for two from separate categories, so one stolen detail, alone, doesn’t get a criminal very far.
How SCA works when you pay online
If you pay by card over the internet, your bank can require a second step: a mobile app-confirmation, a fingerprint scan, or typing in a temporary code texted to your phone. Well-designed SCA links these steps to the exact payee and payment amount (that’s dynamic linking), so a code for a particular payment is useless for anything else.
SCA makes stolen card details a lot less valuable to criminals. But it has a limit, you can still be misled into approving something you didn’t mean to authorize. Our guide covering unauthorised payment refunds explains how those cases are handled and what the rules do not cover.
When SCA exemptions apply
Not every payment needs the full SCA check. The rules make exceptions for transactions that are considered low risk. For example: a coffee paid for contactless under your country's cutoff, subscriptions where the amount doesn’t change, transfers to someone you’ve set as a trusted payee, or low-value online purchases passing your provider’s fraud screens.
It’s your account provider who decides when these exemptions are used, not you. They can still request SCA even if an exception technically applies. If you’re asked to confirm a lot, it probably means their checks picked up something unusual about the transaction.
Frequently asked questions
Why does my bank ask me to approve a card payment in the app?
This is because EU regulation classifies most online card payments as requiring SCA, and mobile app approval meets that rule by adding a second layer of proof linked to you. Approving with your own device is less likely to be mimicked by someone who gets hold of your card details, so banks prefer it to prevent certain common types of fraud.
Is an SMS code good enough for strong customer authentication?
It can count as one factor for SCA, since it proves you control your enrolled phone number. But it’s weaker than app notifications or hardware tokens; SIM swap fraud and trick emails can hijack these codes. For a breakdown of what your provider offers, check our guide to two-factor authentication methods and use the most secure option offered to you.