GlossaryTerm · Fraud & Security

What does SCA mean in banking and payments?

By Tokenova Editorial Desk

The European and UK rule behind the fingerprint or code your bank asks for when you pay online.

7 sources ↓
A key-fob security token displaying a six-digit one-time code
Photo: “RSA-SecurID-Token” by Mateusz Adamowski, taken with Canon EOS., CC BY-SA 1.0 (edited: cropped, colour-graded)

Quick answer

SCA stands for strong customer authentication: a European and UK requirement that payment providers verify you with at least two independent elements, something you know, something you have and something you are, when you log in online or make an electronic payment⁠[1]⁠[2].

Key points

  • SCA needs two factors from different categories: knowledge, possession and inherence.
  • It applies when you access your account online, start an electronic payment or do a risky action remotely.
  • Small contactless and online payments can be exempt within set limits.
On this page
  1. What counts as a factor in SCA?
  2. When can a payment skip SCA?
  3. Is SCA the same as two-factor authentication?
  4. FAQ
  5. Sources

#What counts as a factor in SCA?

The European Commission describes the three categories as something you know (such as a password or PIN), something you own (such as a card or mobile phone) and something you are (biometrics such as a fingerprint or iris scan); you need at least two separate elements from different categories⁠[1]. In UK law, a payment provider must apply SCA when a user accesses a payment account online, initiates an electronic payment, or carries out any remote action that may imply a risk of payment fraud or other abuses⁠[2].

For online payments, SCA also requires dynamic linking: the code you approve must be specific to the amount and the payee, and any change to either invalidates it⁠[3]. For online card payments, the SCA check can be carried through 3-D Secure, which supports two-factor authentication⁠[4].

#When can a payment skip SCA?

The EU rules let banks skip SCA in defined cases, such as contactless payments of no more than €50 within a running limit since the last check⁠[5]. Skipping is always the bank's choice, never the customer's right. The UK's current rules, in force from 19 March 2026, let a provider skip SCA for a contactless payment it identifies as low risk, rather than setting a fixed amount⁠[6].

Worked example

Example: two taps in an EU shop

Ana taps her card for €45. That is within the EU €50 contactless limit, so her bank may approve it without a PIN if the running total and count since her last check are also within the limits. Later she taps for €60. That is above €50, so the contactless exemption cannot apply and the bank will ask for SCA, for example her PIN, before approving it.

€45 contactless
Within the €50 single-payment limit: exemption possible
€60 contactless
Above €50: contactless exemption unavailable, SCA used

#Is SCA the same as two-factor authentication?

Broadly yes: it is a legally defined form of two-factor authentication for payments, created by PSD2. It proves that you approved a payment, but it cannot detect that you were tricked into approving it. For the full picture, read strong customer authentication explained and our guide to passkeys in banking.

Frequently asked questions

Is a password plus a security question SCA?

No. Both are things you know, so they come from the same category; SCA needs two different categories⁠[1].

Does SCA apply outside Europe?

SCA is an EU and UK legal requirement. The EBA and ECB found card fraud far higher when the payee was outside the EEA, where SCA is not legally required and often not used⁠[7].

Sources

  1. Questions and answers on the PSD2 regulatory technical standards on strong customer authentication and secure communication (MEMO/17/4961) — European Commission, 2017 Primary
  2. The Payment Services Regulations 2017, regulation 100 (Authentication) — legislation.gov.uk, 2017 Primary
  3. Commission Delegated Regulation (EU) 2018/389, Article 5 (Dynamic linking) — legislation.gov.uk (original EU text as adopted), 2018 Primary
  4. How Does EMV 3-D Secure Help to Meet European Regulation While Supporting the Global Fight Against CNP Fraud? — EMVCo, 2020 Primary
  5. Commission Delegated Regulation (EU) 2018/389, Article 11 (Contactless payments at point of sale) — legislation.gov.uk (original EU text as adopted), 2018 Primary
  6. FCA Handbook, Technical Standards on SCA and CSC, Chapter 3: Exemptions from strong customer authentication — Financial Conduct Authority, 2026 Primary
  7. Joint EBA-ECB report on payment fraud: strong authentication remains effective but fraudsters are adapting — European Central Bank, 2025 Primary

Read next