# Strong Customer Authentication (SCA): A Practical Guide for SaaS

> Strong Customer Authentication (SCA) is the PSD2 rule requiring two-factor verification on many payments. Learn how SCA works, its exemptions, and how to stay compliant without killing conversion.
- **Author**: Ayush Agarwal
- **Published**: 2026-07-22
- **Category**: Payments, Compliance, Security
- **URL**: https://dodopayments.com/blogs/strong-customer-authentication

---

If you sell to customers in Europe and your checkout conversion dropped without an obvious cause, Strong Customer Authentication is often the reason. SCA is the regulatory rule that forces an extra verification step on many card payments, and when it is implemented poorly, legitimate customers get stuck at a challenge screen and abandon. Implemented well, it barely registers and it shifts fraud liability away from you.

Strong Customer Authentication is a requirement under PSD2, the European Union's second Payment Services Directive, that mandates multi-factor verification for many electronic payments in the European Economic Area and the United Kingdom. In practice it usually shows up as a 3D Secure challenge: a one-time code, a banking-app approval, or a biometric prompt during checkout. This guide explains what SCA requires, the exemptions that keep good customers moving, and how to comply without turning your checkout into an obstacle course.

## What Strong Customer Authentication Requires

At its core, SCA requires that a payment be authenticated using at least two of three independent factors. The idea is that a fraudster who steals one factor, such as a card number, still cannot complete a payment without a second, unrelated factor.

The three categories are:

- **Something the customer knows**, such as a password or PIN.
- **Something the customer has**, such as a phone or hardware token.
- **Something the customer is**, such as a fingerprint or face scan.

A compliant authentication combines two factors from two different categories. A password plus a one-time code sent to a registered phone qualifies. Two passwords do not, because they come from the same category. This two-factor structure is why a banking-app approval on your phone, which combines possession of the device with a biometric, has become the smoothest common method.

The rule applies to customer-initiated electronic payments where both the customer's bank and the business's bank are inside the European Economic Area or the United Kingdom. It is enforced by the issuing bank, which can decline a transaction that should have been authenticated but was not.

## How SCA Shows Up in Practice: 3D Secure

For card payments, SCA is delivered through 3D Secure, and almost always its modern version, 3D Secure 2. When a payment needs authentication, the customer is briefly handed to their bank to verify the transaction before it completes.

```mermaid
flowchart LR
    A[Customer Checks Out] --> B[Payment Request]
    B --> C{SCA Required?}
    C -->|Exemption applies| D[Frictionless Approval]
    C -->|Challenge needed| E[3D Secure Challenge]
    E --> F[Bank Verifies Customer]
    F --> G[Payment Completes]
    D --> G
```

The important detail in 3D Secure 2 is that not every payment triggers a visible challenge. The protocol passes rich context about the transaction to the issuing bank, including device and behavioral signals, and the bank can approve low-risk payments silently. This is called a frictionless flow, and it is the difference between SCA that quietly protects you and SCA that tanks your conversion. Our dedicated explainer on [3D Secure and 3DS payment authentication](https://dodopayments.com/blogs/3d-secure-3ds-payment-authentication) breaks down the protocol mechanics in detail.

A well-configured setup aims to keep as many payments as possible in the frictionless lane and only present a challenge when the risk or the rules genuinely require it.

## The Exemptions That Protect Conversion

SCA comes with a set of exemptions, and using them correctly is the single biggest lever for keeping checkout smooth. When an exemption applies and the business or its provider requests it, the customer can be approved without a challenge.

| Exemption | When it applies |
| --- | --- |
| Low-value transactions | Payments under the regulatory low-value threshold, subject to counters |
| Transaction risk analysis | Low-risk payments where the acquirer's fraud rate is below defined limits |
| Recurring transactions | Fixed-amount subscription charges after the first authenticated payment |
| Merchant-initiated transactions | Charges the customer is not actively present for, such as usage-based billing |
| Trusted beneficiaries | Businesses the customer has added to an allow list at their bank |

Two exemptions matter enormously for subscription and usage-based products. First, once a customer completes an SCA challenge on the initial payment and agrees to future charges, subsequent fixed recurring charges can often proceed without another challenge. Second, merchant-initiated transactions, where you charge a stored card for something like metered usage after the fact, generally fall outside the live-checkout SCA requirement because the customer is not present to authenticate.

This is why the way you set up the first payment matters so much. Capturing proper authentication and consent up front is what unlocks frictionless recurring billing later. The [subscription billing documentation](https://docs.dodopayments.com/features/subscription) covers how stored-credential consent is handled.

## Why SCA Is Not Just a Cost

It is tempting to treat SCA purely as friction to minimize, but it comes with a genuine upside: liability shift. When a payment is authenticated through 3D Secure, fraud liability for that transaction generally moves from the business to the issuing bank. If an authenticated payment later turns out to be fraudulent and the customer disputes it, the business is typically protected from that chargeback.

That changes the calculation. A challenge that adds a few seconds also removes your exposure to a class of fraud chargebacks, which are expensive and time-consuming to fight. For businesses that see meaningful fraud, applying authentication strategically can be net positive even beyond the compliance requirement. Our guide on [chargeback protection](https://dodopayments.com/blogs/chargeback-protection) explains how liability shift fits into a broader fraud-defense strategy, and the piece on [card testing fraud](https://dodopayments.com/blogs/card-testing-fraud) covers a related attack SCA helps blunt.

The goal is balance: authenticate when it protects you or the rules require it, and lean on exemptions when the payment is low-risk and a challenge would only cost conversion.

## Building for SCA Without Building the Plumbing

Implementing SCA correctly means orchestrating a lot: detecting when authentication is required, choosing whether to request an exemption, running 3D Secure 2 with the right transaction data to maximize frictionless approvals, handling challenge outcomes, and doing all of it differently across dozens of issuing banks. It also means keeping up as regulators and networks adjust thresholds and requirements.

For most teams this is not worth building in-house. A payment provider that handles SCA orchestration will:

- Decide per transaction whether an exemption can be requested and pass the right data to claim it.
- Run 3D Secure 2 with rich context so low-risk payments stay frictionless.
- Fall back to a challenge only when needed, then complete the payment.
- Apply the recurring and merchant-initiated exemptions so subscription and usage billing stay smooth after the first payment.

Dodo Payments handles SCA and 3D Secure as part of its checkout and [fraud protection](https://dodopayments.com/payments/fraud-protection) layer, so European and UK payments authenticate correctly without you wiring up 3D Secure yourself. Because Dodo operates as a [Merchant of Record](https://dodopayments.com/payments/merchant-of-record), it also carries the compliance responsibility for these transactions, and its [no-code checkout](https://dodopayments.com/payments/no-code-checkout) is built to keep as many payments as possible in the frictionless lane. You can see the developer view in the [integration guide](https://docs.dodopayments.com/developer-resources/integration-guide).

## Common SCA Mistakes to Avoid

Teams that struggle with SCA usually make one of a few avoidable errors:

- **Challenging every payment.** Not requesting available exemptions means good customers hit friction they never needed, and conversion suffers.
- **Weak first-payment setup.** Failing to capture proper authentication and consent up front means you cannot use the recurring exemption later, so every renewal risks a challenge.
- **Ignoring frictionless data.** Sending minimal information into 3D Secure 2 gives the bank nothing to approve silently, forcing more challenges than necessary.
- **Treating SCA as global.** SCA applies to EEA and UK transactions. Applying the same friction to customers outside that scope adds cost with no compliance benefit. If you sell worldwide, our [cross-border payments guide](https://dodopayments.com/blogs/cross-border-payments-guide) covers how requirements differ by region.

Getting these right is mostly a matter of letting a capable provider make per-transaction decisions rather than applying blunt rules across your entire customer base.

## The Bottom Line

Strong Customer Authentication is not optional for EEA and UK card payments, but it does not have to hurt conversion. The businesses that handle it best request exemptions aggressively, set up the first payment to unlock frictionless recurring billing, feed rich data into 3D Secure 2 to keep most payments silent, and treat the liability shift as a benefit rather than pure friction. Done that way, SCA becomes a quiet layer of protection instead of a conversion tax. To see how Dodo Payments keeps global checkouts compliant and smooth, explore the [payments overview](https://dodopayments.com/payments).

## FAQ

### What is Strong Customer Authentication (SCA)?

Strong Customer Authentication is a PSD2 requirement in the European Economic Area and the United Kingdom that mandates many electronic payments be verified using at least two of three independent factors: something the customer knows, something they have, and something they are. For card payments it is usually delivered through a 3D Secure challenge such as a one-time code or a banking-app approval.

### Does SCA apply to every payment?

No. SCA applies to customer-initiated electronic payments where both the customer's and the business's banks are in the EEA or UK. Several exemptions, including low-value payments, low-risk transactions, fixed recurring charges after the first authentication, and merchant-initiated transactions, allow many payments to proceed without a visible challenge.

### How does SCA affect subscription billing?

Once a customer completes authentication on the initial payment and consents to future charges, subsequent fixed recurring charges can often use the recurring-transaction exemption and skip a new challenge. Setting up that first authenticated payment correctly is what keeps later renewals frictionless.

### Does 3D Secure always show a challenge screen?

No. Modern 3D Secure 2 passes transaction and device context to the issuing bank, which can approve low-risk payments silently in a frictionless flow. A visible challenge only appears when the risk or the rules require it, so a well-configured setup keeps most payments challenge-free.

### Is there any benefit to SCA besides compliance?

Yes. When a payment is authenticated through 3D Secure, fraud liability for that transaction generally shifts from the business to the issuing bank. That protects you from certain fraud chargebacks, which can make strategic authentication worthwhile even beyond the regulatory requirement.
---
- [More Payments articles](https://dodopayments.com/blogs/category/payments)
- [All articles](https://dodopayments.com/blogs)