What Is SCA (Strong Customer Authentication) in Banking?

Bank Strong Customer Authentication, usually shortened to SCA, is a security rule under the European Union’s Revised Payment Services Directive (PSD2) that requires your bank to verify who you are using at least two independent factors before it will let you log in to your account, send a payment, or make certain sensitive changes online.¹ A password alone is no longer enough. You now have to combine something you know, something you have, or something you are, and the two factors have to come from different categories. The detail sits in Commission Delegated Regulation (EU) 2018/389, which spells out how each factor must work, when the extra check can be skipped, and what happens when fraud slips through anyway.

The Two-Factor Rule in Practice

SCA groups authentication into three categories: knowledge, possession, and inherence. Your bank has to use two of them, and they must come from different categories.² A password plus a PIN does not count, because both are knowledge. A password plus a fingerprint does, because knowledge and inherence are separate categories.

Knowledge covers anything only you should know: a password, a PIN, the answer to a security question. The regulation forces banks to defend these against guessing. After five consecutive failed attempts, the bank must block the authentication method, either temporarily or permanently, and offer you a secure way to regain access if the block is permanent.³

Possession is something you physically have. The common examples are your mobile phone receiving a one-time code by SMS or a push notification through the banking app, a hardware token that generates rotating codes, or a FIDO2 security key that plugs into a USB port or connects over Bluetooth. The bank has to take steps to stop these items from being copied or used by anyone else.³

Inherence covers biological traits unique to you: a fingerprint, a facial scan, an iris pattern. The sensors reading your biometrics have to have a very low chance of mistakenly accepting someone else.³

The factors also have to be independent of each other, meaning that cracking one of them cannot reveal or weaken the other.² When both factors sit on the same device, like a smartphone that both receives the push notification and reads your fingerprint, the bank has to isolate them inside separated secure execution environments and verify that the software has not been tampered with.³ This is the defense that stops a stolen phone from becoming a skeleton key to your account.

When Your Bank Will Ask You to Authenticate

PSD2 Article 97 names three moments that trigger SCA. Your bank has to run two-factor verification when you access your payment account online, when you initiate an electronic payment, and when you carry out any remote action that carries a risk of fraud.⁴

In everyday terms, accessing your account online means logging into the website or app to check a balance or review transactions. Initiating an electronic payment covers transferring money to a friend and paying for something online. The third category catches account management changes a fraudster would love: updating your phone number, changing your address, or adding a new payee. Without SCA at these moments, anyone who intercepted your password could quietly redirect your money.

When You Won’t Be Asked

Forcing full authentication on every tap of a card would make daily spending painful, so the regulation lists several exemptions. Each one carries a safety net.

Low-Value Remote Payments

Remote electronic payments under €30 can skip SCA. But once your cumulative low-value payments pass €100, or you have made five of them in a row without being challenged, your bank has to trigger full authentication on the next one.³ That stops a thief draining your account through a stream of small purchases.

Contactless Payments In Store

Individual contactless taps up to €50 can bypass SCA. The cumulative limit is €150 or five transactions in a row, whichever comes first. If your card has ever surprised you by demanding a PIN after a run of tap payments, that was this rule triggering.

Recurring Payments

Subscriptions for a fixed amount, like a streaming service or a gym membership, only need SCA when you first set them up. Later charges for the same amount to the same merchant go through without another prompt.

Trusted Beneficiaries

Most banks let you build a list of trusted payees. Adding someone needs full SCA, but once they are on the list, future transfers to that person or business skip the extra check.⁵ Useful for regular payments to a family member or a landlord.

Transaction Risk Analysis

Banks and payment processors can also skip SCA on a transaction they assess as low-risk in real time, based on your spending patterns, location, and device. The exemption ceiling depends on how good the bank’s fraud record is: a cleaner fraud rate buys the bank room to exempt larger payments, and a bank that lets too much fraud through loses the exemption entirely. Any transaction above €500 always requires SCA.

What SCA Looks Like at Online Checkout

For card payments, SCA runs over a protocol called 3-D Secure. The current version is EMV 3DS, branded by the card networks as Visa Secure, Mastercard Identity Check, and similar names. At checkout, the merchant’s payment system sends transaction details to your card issuer, which then decides whether to authenticate you or apply an exemption.⁶

If the issuer wants authentication, you will see a redirect to the bank’s verification page or get a push notification on your phone. The notification shows the merchant name and the exact amount, and you confirm by scanning your fingerprint or entering a one-time code. The code is mathematically tied to that specific amount and that specific merchant, a technique the regulation calls dynamic linking.⁷ An intercepted code is useless against a different payment.

For low-risk transactions, the protocol runs a frictionless flow: your issuer reviews hundreds of data points about your device, location, and spending history and approves the payment silently. You go from checkout to confirmation without seeing an authentication screen. Visa reports that authenticated transactions through this system show roughly a 45% reduction in fraud compared with non-authenticated online payments.⁶

Why You Should Move Off SMS Codes If You Can

Many banks still default to sending a one-time passcode by text message as the possession factor. It satisfies the rule, but it is the weakest option on offer.

The main threat is SIM swapping: a fraudster talks your mobile carrier into moving your phone number to a new SIM card and then receives every text sent to you. The underlying mobile network also has well-documented vulnerabilities that let sophisticated attackers intercept SMS without touching your SIM at all. Phishing adds another route, tricking you into reading the code aloud or typing it into a fake bank page. None of this works against a push notification sent through an encrypted banking app or a hardware security key that has to be physically plugged in and pressed.

If your bank supports app-based push notifications, switch to those. If you can register a FIDO2 security key, better still. As a backup, set a PIN or passphrase on your mobile carrier account so that a SIM swap is harder to pull off.

If Authentication Fails or You Get Locked Out

If you enter the wrong code or your biometric scan does not match, the transaction is blocked on the spot. That is the system working, though it can be frustrating when the failure is yours rather than a fraudster’s.

Common causes are an expired one-time code (most expire within 60 to 90 seconds), a phone with no signal that cannot receive the SMS, or a biometric sensor confused by wet fingers or poor lighting. Five failed attempts in a row lock the authentication method.³ At that point you have to contact the bank to unlock it.

If you are shut out completely, call the number on the back of your card or visit a branch with photo identification. The bank will verify you another way and either reset your credentials or issue new ones. Some banks run a temporary fallback, like security questions over the phone, while you set up a new device. Keeping your registered phone number current with the bank matters here: recovery is far harder if your number has changed and the bank does not know.

If an Unauthorized Payment Still Goes Through

SCA reduces fraud sharply, but no system is airtight. PSD2 caps a payer’s liability for unauthorized transactions at €50, provided the bank applied SCA properly. If the bank failed to require SCA when it should have, the bank bears the loss. The burden sits on the bank to prove the transaction was properly authenticated and that you either acted fraudulently or were grossly negligent.

Report the problem to your bank as soon as you spot it. Speed is what preserves the cap.

A Note for US Readers

PSD2 does not apply in the United States, and there is no federal law that forces every US bank to implement two-factor authentication for online access. US bank authentication standards flow instead from regulatory guidance and general data-security obligations.

The Federal Financial Institutions Examination Council issued updated guidance in 2021 directing banks to use multi-factor authentication, or controls of equivalent strength, where a risk assessment shows a single password is inadequate. The guidance applies to all federally supervised banks but explicitly does not impose new regulatory requirements.⁸ Most major US banks have adopted multi-factor authentication for online banking, but which factors they offer and when they ask for them vary from one institution to the next.

Separately, the Gramm-Leach-Bliley Act requires financial institutions to maintain an information security program that protects customer data, including measures against unauthorized access.⁹ Federal standards for digital identity, including authentication assurance levels, come from the National Institute of Standards and Technology in its SP 800-63 guidelines, most recently updated to revision 4 in August 2025.¹⁰ These standards shape how US banks design authentication even though they do not carry the force of law in the way PSD2 does in Europe.

Liability for unauthorized electronic transfers in the US runs through Regulation E. Reporting a lost or stolen access device within two business days caps your liability at $50; waiting longer raises it, and waiting more than 60 days after the bank mails the statement can leave you on the hook for everything that happened after the deadline.¹¹ If your US bank offers two-factor authentication as an option, turn it on. The absence of a legal mandate does not change the fact that a single password is an invitation for trouble.

1
European Central Bank. The Revised Payment Services Directive (PSD2) and the Transition to Stronger Payments Security
2
European Banking Authority. 2020_5619 Independence of the Elements for SCA
3
EUR-Lex. Commission Delegated Regulation (EU) 2018/389
4
European Banking Authority. EBA Clarifies the Application of Strong Customer Authentication
5
Legislation.gov.uk. Commission Delegated Regulation (EU) 2018/389
6
Visa. 3D Secure: Your Guide to Safer Transactions
7
European Banking Authority. 2020_5366 Clarification on Dynamic Linking for Strong Customer Authentication
8
FDIC. Authentication and Access to Financial Institution Services and Systems
9
Federal Trade Commission. Gramm-Leach-Bliley Act
10
NIST. Digital Identity Guidelines
11
Consumer Financial Protection Bureau. Liability of Consumer for Unauthorized Transfers