Strong Customer Authentication (SCA)

SCA has applied since September 14, 2019 under the EU’s second Payment Services Directive (PSD2), and in the UK under its own rules. It requires two of three factors: something the customer knows, has or is. For online card payments, it is met through 3D Secure, the network protocol that asks the cardholder to confirm in their banking app or with a code.

Recurring billing is handled through exemptions. The customer authenticates when the card is saved, then later renewals can be sent as merchant-initiated transactions, without the customer present. The issuer can still ask for authentication on a renewal, which surfaces as a decline such as authentication_required.

For subscriptions, the fix is to bring the customer back to complete authentication: send a link to a page where they can confirm the payment. Successful 3D Secure authentication also typically shifts liability for fraud disputes to the issuer, though processors note it is not guaranteed.