Strong customer authentication (SCA)

Roles that need it

• Fraud Analyst
• Product Owner (Banking)
• Payments Partnerships Manager (Acquiring & Gateways)
• Regulatory Change Analyst
• Merchant Acquiring Sales Executive

Skills it belongs to

• Payments and cards products (schemes, chargebacks, PSD2, open banking)
• Fraud typologies and controls
• Identity and access management

Related concepts

• PSD2 (Second Payment Services Directive)The second Payment Services Directive, Directive (EU) 2015/2366 (PSD2), is the EU law on payment services and their providers, applicable since January 2018. It sets authorisation, transparency, execution time and liability rules, created regulated payment initiation and account information services, and required strong customer authentication. PSD3 and the PSR will replace it.
• 3-D Secure (3DS)3-D Secure is the protocol card issuers use to authenticate the cardholder in online card payments, maintained by EMVCo as EMV 3-D Secure. The merchant sends transaction and device data, and the issuer approves without friction or challenges the cardholder, for example in a banking app. It is the main way to apply strong customer authentication to cards and moves fraud liability to the issuer.
• ChargebackA chargeback is the reversal of a card transaction started by the cardholder's bank (the issuer) under card scheme rules after the cardholder disputes it, for reasons such as fraud or goods not received. The merchant's bank (the acquirer) debits the merchant, who can contest it through representment and, if needed, scheme arbitration.
• Open bankingOpen banking is the secure sharing of payment account data, and the initiation of payments, by authorised third-party providers with the customer's consent, through bank interfaces that are usually APIs. In the EU it stems from PSD2, and in the UK from a 2017 competition order. Its extension to savings, investments and pensions is called open finance.

Sources

• Directive (EU) 2015/2366 on payment services in the internal market (PSD2), EUR-Lex (external site) accessed 31 Oct 2026
• Commission Delegated Regulation (EU) 2018/389 on strong customer authentication and common and secure communication, EUR-Lex (external site) accessed 31 Oct 2026

Updated 31 Oct 2026.