Glossary
Strong customer authentication (SCA)
Strong customer authentication, SCA, is the requirement of the EU's PSD2 and the UK's payment regulations that a payer authenticates an electronic payment with two independent factors: something they know, something they have or something they are. For cards it is delivered through 3-D Secure; for bank payments through the bank's own app. Exemptions cover low amounts, low-risk transactions, trusted beneficiaries and recurring payments after the first one; merchant-initiated transactions are outside its scope.
Who decides
The payer’s bank, the issuer, is responsible for authenticating and decides whether to apply an exemption the acquirer requested; the acquirer and the merchant can request exemptions but cannot force them. Outside the EU and the UK the rules differ: India mandates two-factor authentication for domestic card payments, other markets leave it to issuers and schemes.
What it does to a checkout
A challenge interrupts the payment and costs conversion; exemptions and frictionless authentication keep most low-risk payments silent. Recurring charges and merchant-initiated transactions are out of scope after an authenticated first payment, which is why tokenised subscriptions keep working without the payer.
On the platform
Tranzify’s checkout runs 3-D Secure where the issuer asks, requests the exemptions the schemes allow for merchant-initiated charges with a token, records the authentication result with each payment and treats an authentication failure as a hard decline.
Updated: 2026-11-08