What is strong customer authentication and why does your bank ask for it?

#What does strong customer authentication actually mean?

Authentication is how a bank checks that the person asking to log in or pay is really the account holder. A password on its own is weak authentication: if someone learns it, they can pretend to be you. Strong customer authentication, usually shortened to SCA, raises the bar by asking for two different kinds of proof. The European Commission summarises the rule this way: users must provide at least two separate elements out of three categories, something they know (a password or PIN), something they own (a card or a mobile phone) and something they are (biometrics such as a fingerprint or iris scan)⁠^[1].

The rule comes from the EU's second Payment Services Directive, known as PSD2, and its detailed technical standards⁠^[1]. The UK has the same requirement in its own Payment Services Regulations 2017⁠^[2]. Our guide to PSD2 covers the wider law; this page focuses on the login and payment checks you meet every day. For a one-paragraph version, see the glossary entry on SCA.

Not everything that looks like a second factor counts. The European Banking Authority (EBA), the EU's banking standards body, said in a 2019 Opinion that the card number and security code printed on a card cannot count as a knowledge element, and that an app on a phone can only prove possession if the bank uses a device-binding process tying the app to that particular device⁠^[3]. The same Opinion lists fingerprint, face and voice recognition, and even the angle at which a device is held, as possible inherence elements⁠^[3].

#When must a bank ask for SCA?

UK law spells out three situations. A payment service provider must apply strong customer authentication when a user accesses a payment account online (directly or through an account information service), initiates an electronic payment transaction, or carries out any action through a remote channel that may imply a risk of payment fraud or other abuses⁠^[2].

For online payments there is an extra layer called dynamic linking. The EU technical standard requires that you are shown the amount and the payee, that the authentication code is specific to that amount and payee, and that any change to either one invalidates the code⁠^[4]. In plain terms: if malware on your laptop quietly changes the payee or adds a zero, the approval you gave no longer works.

#When did SCA start, and where does it apply?

SCA is a European and UK requirement. It covers payment providers operating there, which is why a shop elsewhere in the world may never trigger an SCA check at all. For online card payments, SCA is commonly carried out through 3-D Secure, a messaging protocol that lets cardholders authenticate themselves with their card issuer during an online purchase; EMVCo says it supports SCA by enabling two-factor authentication⁠^[9].

#Which payments can skip SCA?

Asking for a fingerprint on every bus fare would be annoying, so the rules allow exemptions. An exemption means the bank is allowed not to apply SCA; it is never obliged to skip it. The main ones in the EU technical standards are:

• Contactless at the till: in the EU, each tap may skip SCA if it is no more than €50 and either the total since the last SCA check is no more than €150 or there have been no more than five taps in a row⁠^[10].
• Low-value online payments: a remote payment of no more than €30 may skip SCA, as long as the total since the last check is no more than €100 or there have been no more than five such payments⁠^[11].
• Transaction risk analysis: a bank may skip SCA for an online payment its monitoring system identifies as low risk⁠^[12].
• UK differences: the UK's low-value online limit is £25 with an £85 running total or five payments, and the UK contactless exemption now depends on the provider judging the payment low risk⁠^[7].

#Does SCA actually reduce fraud?

The best public evidence is the joint report of the EBA and the European Central Bank (ECB). In December 2025 they reported that transactions verified with SCA were generally less susceptible to fraud than those without it, especially card payments, and that card payment fraud was 17 times higher when the payee was outside the European Economic Area (EEA), where SCA is not legally required⁠^[13]. Overall fraud across the EEA was still €4.2 billion in 2024, up from €3.5 billion in 2023⁠^[13].

The same report warns that fraudsters are adapting: new fraud often targets payments where an exemption was used, or manipulates real customers into authenticating fraudulent transactions themselves⁠^[13]. That second problem is called authorised push payment fraud. SCA proves you approved a payment; it cannot prove you were not lied to.

#How is SCA changing next?

In November 2025 the EU Council and Parliament reached a provisional agreement on a new Payment Services Regulation that adds anti-fraud tools on top of SCA, including checking that the IBAN matches the account name before any transfer and new rules on fraud where criminals impersonate a bank⁠^[14]. That deal still needed formal adoption when it was announced. By October 2026 the European Parliament's Legislative Observatory listed the file as awaiting the Council's first-reading position, with an indicative plenary date of 14 December 2026, so it was not yet law⁠^[15]. Banks are also moving from text-message codes to app-based and biometric checks; our guide to passkeys in banking explains why.