Strong customer authentication

What it means

Strong customer authentication, or SCA, is the PSD2 requirement for verifying identity in electronic payments and access to a payment account. The customer must prove their identity with at least two independent elements from three categories: something they know, such as a PIN or password; something they have, such as a phone or card; and something they are, such as a fingerprint or face.

The elements must be independent, so compromising one does not endanger the others. Remote payments also require dynamic linking: the authentication is tied to a specific amount and payee, so an attacker cannot reuse a captured code for another payment. It is a specific, regulated form of two-factor authentication.

For online card payments SCA is carried out through 3D Secure, with the issuing bank asking the cardholder to confirm in a mobile app. In online banking it covers sign-in and payment authorisation. The rules apply to consumers and business customers alike.

How it works in practice

For a company as payer, everyone who enters and approves payments in the bank needs their own authentication device. Sharing one phone or token among several people is risky and defeats the purpose of the rules. For bulk payments, banks may under certain conditions apply exemptions for corporate payment processes.

For an online store receiving payments, SCA means slightly more abandoned purchases, but also lower fraud risk and a shift of liability for disputed transactions to the issuing bank. Payment gateways use exemptions, for example for low amounts or trusted beneficiaries, so that customers are not burdened unnecessarily.

SCA also applies when connecting accounting software to the bank through open banking. When granting consent to read statements via OAuth, the customer passes SCA, and the consent must then be renewed periodically. Companies should keep track of who they have granted account access to and for how long.

What to watch out for

Fraudsters try to get around SCA through social engineering, calling on behalf of the bank and asking the customer to confirm an operation in the app or reveal a code. A bank never asks you to confirm a payment you did not enter yourself. Staff who approve payments should be trained regularly on these scenarios.

When a phone is replaced, an employee leaves or a device is lost, authentication tools at the bank must be blocked or re-registered immediately. An old phone with an active banking app is a security risk. Changing access should be part of the onboarding and offboarding process.