Last updated April 2022.
In 1979, something monumental occurred when Visa introduced a point-of-sale terminal to merchants. For the first time, consumers could choose to spend directly from their bank accounts via a single plastic card rather than being limited to the cash in their wallet.
A tremendous shift in the way merchants and consumers could exchange goods and services, this card payment experience would remain virtually unchanged for the next quarter of a century.
Then in 2006, Chip & PIN was formally adopted to combat fraud on lost, stolen and counterfeit cards. From 14 February, all card transactions would require customers to enter their PIN at the checkout.
Described as the “largest change in the way we pay since decimalisation”, Chip & PIN marked the end of the customer signature and sparked a rapid succession of digital payment innovations. In 2007, the first contactless credit cards were issued by Barclaycard in the UK. Contactless debit cards would follow just two years later.
Ahead of its time, contactless would not take off as a serious payment method in the UK until 2012, when NFC technology became more readily available to merchants. Apple Pay, Samsung Pay and Google Pay would then arrive in quick succession over the next three years.
It legitimised contactless and mobile payments in the eyes of merchants and consumers alike, as well as helping tosolve the experience gap between in-store and online shopping, these innovations confirmed the now unrivalled position of digital payments.
However, this shift towards a more convenient and frictionless payment experience, where consent and acceptance became an instant tap or click, inevitably created more risk and fraud potential, both for merchants and their customers.
Identifying the accelerating changes to how digital payments are now made and accepted, in 2013 the European Commission sought to reinforce payment security and consumer protection, part of an initiative that would come to be known as Payment Services Directive Two (PSD2).
Born out of PSD2, the term Strong Customer Authentication (SCA) came to everyone’s attention. In short, SCA is a new set of legal payment requirements that consist of additional security steps that need to take place when a customer makes certain purchases.
SCA affects virtually every EU merchant selling online. The EU and the UK's Financial Conduct Authority (FCA) requires relevant businesses to have a fully compliant SCA strategy in place.
This guide will take you through everything you need to know about SCA, how could affect your business, the steps you may need to take, and what Judopay can do to help ensure you have a fully compliant strategy in place.
Strong Customer Authentication (SCA) is an EU and UK legal requirement for online payments.
As consumers purchase more goods and services online, the need to authenticate identity during transactions has become essential in making payments more secure and reducing cases of fraud.
In the past, shoppers were only required to enter their financial details to complete an online purchase. SCA regulation requires merchants to include an extra layer of security when their customers make an online payment.
The FCA has been working with the industry to put in place stronger means of ensuring thatanyone seeking to make payments is not a fraudster. While these measures will reduce fraud,we also want to make sure that they won’t cause material disruption to consumersthemselves; so we have agreed a phased plan for their timely introduction. Small Businesses.
In 2022, SCA became mandatory for most online UK transactions (excluding SCA exemptions) and became mandatory across most of Europe in December 2020. Many consumers will still experience a standard payment flow. But, if an Issuer challenges the transaction (i.e. requires more data to confirm the cardholder is the person making the transaction) the consumer will be asked to provide a combination of two of the following authentication factors:
Something you are.
(e.g. fingerprint, face recognition, voice pattern)
Something you know.
(e.g. PIN, password, passphrase, secret fact, sequence)
Something you have.
(e.g. card, smartphone, wearable device)
Many of your customers will already be familiar with two-factor authentication (even if they don’t know the terminology).
As an example:
When a customer is asked to enter a one-time code sent to their smartphone (something they HAVE) after they’ve entered their password (something they KNOW) to access online banking.
Merchants should focus on implementing 3DS2 now to allow time to test, tweak and test again before the SCA deadline. IMRG.
Yes, all merchants taking online payments need to comply with SCA, but there are exemptions that will apply to some businesses:
While SCA is the legal requirement, 3DS2 is an SCA compliant authentication service. 3DS2 is what adds an extra layer of security to the payment flow to make them SCA compliant. In most cases this will remain a seamless experience, but if the Issuer isn’t completely satisfied that the real cardholder is the one making the purchase, they’ll ask for some additional input to authenticate the transaction.
Customer enters their card details on your checkout page to start the payment.
Judopay’s 3DS2 solution checks if authentication isrequired. Depending on the issuer’s requirements, we’ll share data such as shipping address, customer location or device ID to assure them that the real cardholder is making the purchase.
Option 1: If the issuer is satisfied they’ll authenticate the payment.
Option 2: If the issuer isn’t satisfied with the ID and risk credentials, the customer will be asked for some additional input to authorise the payment (something they KNOW, HAVE, ARE).
Once the issuer is satisfied that the real cardholder is the one making the payment, the payment can be completed.
