What is SCA Verification? SCA Verification Review, Features

SCA verification (Strong Customer Authentication) is a new form of two-factor authentication designed to add extra security for online payment consumers.

About SCA Authentication

Once SCA verification is implemented, banks in 31 countries and regions within the European Economic Area must verify the identity of online buyers before processing payments. This verification requires multi-factor authentication to help ensure that consumers' online purchases are safe and protected. The European Banking Authority (EBA) announced that it will fully implement SCA from December 31, 2020.

Purpose

The EU will adopt SCA verification for multi-factor authentication to help prevent online fraud and unauthorized access to consumers' accounts, ensuring that only consumers can make purchases using their own payment credentials.

Authentication Type

1. The user's password or PIN code (excluding payment card information).

2. The user’s smartphone or wearable device.

3. User fingerprint biometrics or facial scanning.

Transactions that do not meet these requirements will be rejected unless the transaction qualifies for an exemption from certification.

Exemptions

1. Transactions initiated by merchants

This includes repeated purchases of the same amount from the same merchant, where SCA certification is required for the first payment to the merchant. At this time, subscription services that are billed on a monthly basis (such as subscriptions that generate different amounts every month, an example is a utility bill) and various other types of "over-the-counter" payments (such as crowdfunding) will not fall under this exemption.

2. Low transaction amount

Purchases under 30€ are not subject to SCA, but will require SCA validation once 5 transactions under 30€ have been completed or the total value of these transactions reaches 100€. At this point, the Transaction Count will reset after SCA validation.

3. Trustworthy beneficiaries

Under this exemption, cardholders can ask their issuer to “whitelist” a merchant so that future transactions do not require SCA to be applied. While it is the issuer’s responsibility to manage the whitelist for each cardholder, this exemption warrants careful consideration by merchants and their payment partners to ensure their frequent customers have the best payment experience possible.

4. Transaction Risk Analysis (TRA)

TRA is perhaps the most important exemption, as it allows merchants to avoid SCA requirements if their payment provider's total fraud rate is below a certain threshold. For transactions under €100, the fraud threshold is 0.13%, for transactions between €100 and €250, it is 0.06%, and for transactions between €250 and €500, it is 0.01%. If the payment provider's fraud rate is below these thresholds, real-time risk analysis can be applied to the transaction to assess whether SCA certification should be applied.

5. Ensure corporate card payment security

Transactions made through corporate cards will not be subject to SCA if the corporate card is "on deposit" (e.g. a travel agency that books airline tickets for employees) or uses a virtual card number. It is important to note that applying the exemption is optional. The card issuer will be liable for fraud in all transactions where SCA is applied, but when the exemption is included as part of EMV 3DS, the fraud liability will be borne by the payment provider (usually ultimately the merchant) rather than the card issuer.

Influence

The new SCA rules are of great significance to cross-border sellers and local European sellers. The most direct impact on sellers is the impact on buyers' payment experience. In other words, by introducing additional steps to complete a purchase, it will add obstacles to successful purchases. Although shopping cart abandonment and reduced conversion rates are reasonable concerns, on the other hand, if SCA works as expected, it may increase authorization rates while reducing fraud losses.