Strong customer authentication (SCA) and 3D Secure: requirements, exemptions, and conversion

The European Revised Payment Services Directive (PSD2) transformed e-commerce payments by establishing strong customer authentication, commonly known as SCA. This regulatory requirement obliges businesses to verify a cardholder's identity using at least two independent factors across three distinct categories: knowledge (something they know, such as a password or PIN), possession (something they own, like a smartphone registered via mobile banking notifications), and inherence (biometrics, including facial recognition or fingerprints).

To implement this mechanism across card payments on the web, the card networks and banking sector established the 3D Secure 2.x standard. While this framework significantly curbs payment fraud, it introduces additional customer touchpoints. Understanding when SCA is mandatory, how technical exemptions function, and the resulting impact on cart abandonment within a payment gateway is vital for any digital company operating in Europe.

Regulatory scope: what falls inside and outside the mandate

SCA does not apply universally to every payment. The EU mandate restricts its scope to remote electronic transactions initiated by the cardholder (*Customer-Initiated Transactions* or CIT) where both the card-issuing bank and the acquiring merchant acquirer operate within the European Economic Area (EEA).

Transactions falling outside the direct scope of SCA include:

• One-leg out transactions: payments where either the card issuer or the merchant acquirer is located outside the EEA (for instance, a shopper using a United States credit card to purchase services on a Spanish website).
• Mail order and telephone order (MOTO): classic distance sales executed manually by staff without the consumer entering credentials into an interactive web form.
• Merchant-Initiated Transactions (MIT): charges processed without active customer involvement at the precise time of execution. Examples include recurring billing for subscriptions and usage-based metered charges. Under regulatory guidelines, the initial transaction where payment credentials are saved requires full SCA to establish a valid mandate; subsequent automated charges remain out of scope as long as they adhere to the agreed parameters, an essential design point in the automatic renewal of subscriptions.

The PSD2 exemption framework

To prevent routine low-risk transactions from triggering repetitive biometric prompts, PSD2 allows merchants and acquirers to request specific exemptions. However, the final decision to grant or decline an exemption always rests with the issuing bank, which evaluates risk before approving the charge or demanding full verification.

Low-value transactions

Remote purchases below €30 can qualify for a direct exemption. Nevertheless, the card issuer tracks cumulative activity: if a customer completes five consecutive low-value transactions without SCA, or if the cumulative value of uninterrupted unauthenticated transactions exceeds €100, the system must trigger a challenge on the subsequent transaction.

Transaction risk analysis (TRA)

The Transaction Risk Analysis exemption permits merchants and acquirers to bypass SCA on transactions up to €100, €250, or €500, provided that the overall fraud rate of the processing acquirer or issuer remains below strict regulatory thresholds (0.13%, 0.06%, and 0.01% respectively). If the processing partner maintains a low fraud ratio, low-risk orders within those bands can flow seamlessly without interruption.

Trusted beneficiaries (whitelisting)

Cardholders have the right to register specific online businesses on a trusted beneficiary list managed directly through their banking portal or mobile app. Once an initial payment completes SCA and the merchant is whitelisted, future purchases bypass additional challenges unless the bank detects abnormal security signals.

Friction, abandonment, and the liability shift

The 3D Secure 2 protocol provides two technical pathways: the frictionless flow, where the card issuer evaluates device data, behavioral patterns, and historical parameters in milliseconds to authorize the payment without screen transitions, and the challenge flow, where an explicit modal prompts the shopper for biometric approval or a one-time passcode.

Whenever a transaction enters a challenge flow, the risk of customer drop-off escalates. SMS delivery delays, banking app connectivity issues, and user hesitation when redirected through bank modals introduce measurable conversion drag in online payments.

However, completing authentication delivers a crucial commercial safeguard: the liability shift. When a transaction successfully completes SCA via a 3D Secure challenge, the financial liability for unauthorized fraud-related chargeback claims shifts from the merchant to the card-issuing bank. When a merchant requests a TRA exemption and the issuer accepts it through a frictionless path, scheme rules typically govern whether the liability remains with the merchant or the acquirer. Conversely, if an issuer declines an exemption request, it responds with a specific code (*soft decline*). The payment gateway must then immediately restart the transaction and present a 3DS challenge, preserving the purchase without an outright failure.

Conclusion

Managing SCA is not a straightforward trade-off between total security and low-friction conversions. Modern checkout architectures assess transaction attributes dynamically to request exemptions where permitted by transaction size and risk models, handling soft declines smoothly so that consumers only face active challenges when regulation or genuine fraud defense requires it.