Strong customer authentication, or SCA, is the obligation introduced by the European payment services directive PSD2 to verify the identity of anyone paying online with at least two independent factors. For an e-commerce business it means that almost every card payment passes through a verification protocol, 3-D Secure 2, which decides whether to ask the customer for an extra step or let them pay without friction. This article, first published in 2020 when the obligation was about to take effect and updated in 2026, explains what the rules require, how 3-D Secure 2 works, which exemptions exist, how to limit the impact on conversion, and what will change with the revision of the European rules now under way.
TL;DR
- PSD2 (Directive (EU) 2015/2366) requires strong customer authentication for electronic payments: two factors out of knowledge, possession and inherence.
- 3-D Secure 2 is the protocol through which banks and merchants apply the rule; the "frictionless" flow authenticates the customer without asking anything when the risk is low.
- Exemptions (low amounts, risk analysis, trusted beneficiaries, recurring payments) are the lever for reducing friction, but the card issuer decides them.
- An online shop must send complete data to the protocol, handle "soft declines" and measure the impact on conversion.
- The European Commission's PSD3 and PSR proposals revise these rules; check the state of the legislative process before planning changes.
What does PSD2 require from an online shop?
PSD2 requires that electronic payments initiated by the customer be protected by strong customer authentication, the combination of at least two independent factors, unless an exemption in the technical rules applies. Directive (EU) 2015/2366 has been in force since 13 January 2018, and its purpose is to increase the security of transactions and fight fraud by strengthening authentication. (eur-lex.europa.eu)
The three factors are the same as in 2018:
- Knowledge: something the customer knows, such as a password or PIN.
- Possession: something the customer has, such as the smartphone that receives a notification or code.
- Inherence: something the customer is, such as a fingerprint or facial recognition.
The detailed technical requirements, including the exemptions, are in Delegated Regulation (EU) 2018/389, the regulatory technical standards on strong customer authentication. (eur-lex.europa.eu) For the merchant, the practical consequence is that the payment gateway has to support 3-D Secure 2 and send the data that lets the customer's bank assess the risk.
How does 3-D Secure 2 work?
3-D Secure 2 is the protocol through which the merchant, the payment provider and the bank that issued the card exchange transaction data and decide how to authenticate the customer. Compared with the first version, which almost always asked for a code by SMS, the second has two paths: challenge authentication and frictionless authentication.
In the challenge path the customer confirms the payment with two factors, usually by approving a notification in their banking app or entering a code plus a password. In the frictionless path the bank authenticates the customer on the data it receives, such as device, delivery and billing address, history and amount, without asking them anything.
The issuing bank chooses the path by analysing the transaction's risk with the data the merchant sends: the more complete the data, the more likely the frictionless path. The protocol specification is maintained by EMVCo. (emvco.com)
Which exemptions from strong customer authentication exist?
The exemptions in the technical standards cover low-value payments, transactions that risk analysis classifies as safe within thresholds tied to fraud rates, beneficiaries the customer has marked as trusted, and fixed-amount recurring payments after the first one. Payments initiated by the merchant, such as charges to a saved card, fall outside the scope of the obligation.
| Exemption | When it applies | Who decides |
|---|---|---|
| Low value | Transactions under the threshold in the technical standards, with cumulative limits | Issuing bank |
| Transaction risk analysis (TRA) | Low-risk transactions within thresholds tied to the payment provider's fraud rate | Payment provider or issuing bank |
| Trusted beneficiary | Merchants the customer has added to a list at their bank | Customer and issuing bank |
| Recurring payments | Fixed-amount charges after the first, to the same beneficiary | Issuing bank |
| Merchant-initiated payments | Charges to saved credentials with the customer absent | Out of scope, with an authenticated initial mandate |
Exemptions are a request, not a right: the merchant proposes them through its gateway and the customer's bank decides. An online shop that works well with its gateway on exemptions removes unnecessary challenges without losing security.
How do you limit the impact of strong authentication on conversion?
You limit the impact on conversion by sending complete, correct data to the protocol, using exemptions where they apply, handling "soft declines" by retrying the payment with authentication, and measuring the challenge rate and abandonment per gateway and bank. Every extra step in checkout costs conversion; the goal is for the challenge to appear only when it is needed.
The checklist we apply on e-commerce projects:
- Complete data. Addresses, e-mail, phone, device and account history sent to 3-D Secure 2 in every request.
- Exemptions configured. Low-value and risk-analysis exemption requests enabled with the gateway, with the acceptance rate monitored.
- Soft declines handled. If the bank refuses an exempted transaction and asks for authentication, the payment is retried with the challenge without the customer starting over.
- Saved cards and subscriptions. First payment authenticated, later charges as merchant-initiated payments with the correct mandate.
- Measurement. Challenge rate, challenge success rate, checkout abandonment and fraud, by card scheme and by bank.
- Testing. Gateway test scenarios for the challenge, frictionless and soft-decline paths, repeated at every checkout change.
These points are part of building a custom e-commerce web application and of the compliance and security audits we run on payment systems; our article on e-commerce with Sitecore shows how payment integrates into a commerce platform.
What changes with PSD3 and PSR?
In June 2023 the European Commission proposed a revision of the framework: a new directive (PSD3) and a payment services regulation (PSR) that would apply uniform rules across the Union, with changes to strong customer authentication, fraud-data sharing and consumer protection. The proposals are going through the European legislative process, and the final texts and their application dates should be checked on EUR-Lex before planning checkout changes. (finance.ec.europa.eu)
For an online shop the direction is clear even before the final texts: strong authentication stays, risk-based exemptions become more important, and the quality of the data sent to the protocol keeps deciding how many payments go through without friction.
Want to check how your checkout handles strong authentication and exemptions? Talk to a WWG engineer at business@wwg.it.
Sources
FAQ
Frequently Asked Questions
It is the obligation, introduced by PSD2, to verify who is paying online with at least two independent factors out of knowledge (a password), possession (a smartphone) and inherence (fingerprint or face). It applies to customer-initiated electronic payments in the European Economic Area, unless an exemption in the technical standards applies, and is implemented through the 3-D Secure 2 protocol.
No. In the frictionless path the customer's bank authenticates the payment on the data received from the merchant and the gateway, without asking anything. The two-factor challenge appears only when the risk is judged high or no exemption applies. The more complete the data the shop sends, the more payments go through without friction.
Low amounts within the limits in the technical standards, low-risk transactions under the payment provider's risk analysis, payments to beneficiaries the customer has marked as trusted, and fixed-amount recurring charges after the first. Merchant-initiated payments on saved cards stay out of scope if the initial mandate was authenticated.
That is the European Commission's June 2023 proposal: a new PSD3 directive and a PSR regulation with uniform payment rules, including strong customer authentication. The texts have to complete the legislative process and the application dates depend on it, so check the current state on EUR-Lex before planning checkout work.
