Strong Customer Authentication Explained for UK Merchants
Strong Customer Authentication sounds like jargon, but the idea behind it is simple: it is the quick check that proves a payment is really being made by you. This guide explains it in plain terms, shows where it applies, and explains why paying by bank makes it painless.
Strong Customer Authentication (SCA) is a UK security rule for electronic payments. Before a payment goes through, the customer proves it is really them using at least two of three things: something they know, something they have, and something they are. In everyday life, that is the quick fingerprint or face check when you approve a payment. It applies to card payments, digital wallets, and Pay by Bank alike, and this guide explains what that means for you.
What SCA Is, in Plain Terms
Strip away the jargon and Strong Customer Authentication is simple. It is a security check that makes sure the person making a payment is really you. Rather than trust a single detail like a password, which a fraudster could steal, it asks you to prove it in two different ways. That proof comes from at least two of these three things:
Something you know
Knowledge only you should have, such as a password, a PIN, or a passphrase.
Something you have
An item only you should hold, such as your phone, a registered device, or your card.
Something you are
A physical trait unique to you, such as your fingerprint or your face.
The one rule to remember is that the two factors must come from different groups above. A fingerprint plus your phone counts. A password plus a memorable word does not, because both are things you know. This is why the everyday example, approving a payment on your phone with your face or fingerprint, works so neatly: the phone is something you have, and your face is something you are.
Now the part most merchants miss: once you understand SCA this way, it is clearly not just a card feature. It is a rule about proving identity that applies across most electronic payments, so the real question is not whether you need it, but which payment method makes it least painful for your customer. That is what the rest of this guide is about.
Where SCA Applies
SCA turns up in more places than most people realise. The requirement is the same, but the experience is very different depending on how you take the payment.
Online card payments
Card payments meet SCA through 3-D Secure, the step where you confirm the payment in your banking app or with a one-time code. It works, but the extra screen is a common cause of checkout drop-off.
3-D Secure at online checkoutDigital wallets
Apple Pay and Google Pay combine the device you hold with your fingerprint or face, which meets SCA automatically. That is why wallet payments feel seamless while staying strongly authenticated.
Apple Pay, Google PayPay by Bank
When a customer pays by bank, their own bank applies SCA as they approve the payment, using their normal login and a fingerprint or face scan. The authentication is built into the payment, not bolted on at checkout.
Open banking, in the bank appIn person, SCA is quietly at work too: chip and PIN is a textbook example, combining the card you hold with the PIN you know. Contactless is allowed to skip it up to a limit, which we come to below.
How SCA Works With Open Banking and SSV SmartPay
Here it helps to picture a real payment. Say a customer is buying something online for £45. With a card, they type in their card details, and then a separate Strong Customer Authentication step appears, the 3-D Secure screen, asking them to confirm in their banking app or with a code. It is a second hoop, and every extra hoop at checkout is a chance for them to give up.
With Pay by Bank, the method SSV SmartPay uses, there is no separate step to bolt on. To pay, the customer is already in their own banking app, and they confirm with the fingerprint or face scan their bank always uses. That confirmation is Strong Customer Authentication. The security check and the payment are the same action, so there is no extra pop-up to load, no one-time code to wait for, and no second system that can fail.
Because SCA is native to the payment, Pay by Bank avoids the extra 3-D Secure step that causes card checkout drop-off, while still being strongly authenticated by the customer’s bank. You get the security without the friction, rather than trading one for the other.
It is also less for you to manage. You are not responsible for triggering SCA, applying exemptions, or fixing a 3-D Secure screen that would not load. The customer’s own bank does the authentication, exactly as it does every time they log in or approve anything else.
“With cards, SCA is a step you add. With Pay by Bank, SCA is the step, so there is nothing extra to go wrong.”
Common Exemptions and Thresholds
SCA does not apply to every single payment. The rules include exemptions so that low-risk and low-value payments stay quick. These are applied by banks and payment providers, not chosen by you, but it helps to know they exist.
| Exemption | Typical threshold | What it means |
|---|---|---|
| Low-value payments | Around £30 or under | Small payments can skip SCA, up to a cumulative limit before it is triggered again |
| Contactless (in person) | Up to the contactless limit | Taps skip SCA until a cumulative limit is reached, then a PIN is requested |
| Transaction Risk Analysis | Set by provider fraud rates | Providers with low fraud can exempt low-risk payments up to value thresholds |
| Recurring & merchant-initiated | Fixed or agreed payments | After the first authenticated payment, later fixed ones can be exempt |
| Trusted beneficiaries | Set by the customer | A customer can add a merchant to a trusted list at their bank to skip repeat SCA |
Thresholds are typical and simplified, and they can change. Exact figures and cumulative limits are set in the rules and by individual banks and providers, so treat this as a general guide.
A quick reassurance: you do not have to become an expert in exemptions. Your payment provider and the customer’s bank apply them automatically. Knowing they exist simply explains why some payments ask for authentication and others do not.
Frequently Asked Questions
What is Strong Customer Authentication (SCA)?
SCA is a security requirement for electronic payments in the UK and EU that asks a customer to prove who they are using at least two of three independent factors. It is designed to cut fraud, and it is why you are often asked to approve an online payment in your banking app or with a fingerprint.
What are the three SCA factors?
Knowledge (something only you know, like a password or PIN), possession (something only you have, like your phone or card), and inherence (something you are, like a fingerprint or face). SCA needs at least two from different categories, so a password plus a fingerprint counts, but two passwords would not.
Does SCA apply to Pay by Bank?
Yes, and the customer’s own bank handles it. When someone pays by bank, they approve the payment in their banking app with their normal login and biometric, which already meets SCA. The authentication is built into the payment rather than added on by the merchant.
What payments are exempt from SCA?
Common exemptions include low-value payments (typically around £30 or under, up to cumulative limits), in-person contactless up to the limit before a PIN is needed, low-risk payments under Transaction Risk Analysis, fixed recurring and merchant-initiated payments after the first, and merchants a customer has added as a trusted beneficiary. Thresholds can change, so check the current FCA position.
Do digital wallets like Apple Pay meet SCA?
Usually, yes. Paying with Apple Pay or Google Pay combines the device you hold with your fingerprint or face, which satisfies SCA. That is why a wallet payment feels seamless while still being strongly authenticated.
Did SCA rules change in 2026?
The UK has been reforming its payments regulation, including moving SCA rules out of retained EU law and towards rules set by the FCA, with a more outcomes-based approach under discussion. The exact changes and timing keep evolving, so check the FCA for the current position rather than relying on a fixed date.
Continue exploring SSV SmartPay
References
- Financial Conduct Authority. Strong Customer Authentication. Available at: https://www.fca.org.uk/firms/strong-customer-authentication
Important information
General guide, not compliance advice. This article explains Strong Customer Authentication in general terms for UK merchants. It is not legal, regulatory, or compliance advice. For your own obligations, check the FCA and speak to your payment provider.
Thresholds are typical and can change. Exemptions, values, and cumulative limits are set in the rules and applied by banks and providers, and they change over time. Confirm current figures rather than relying on those shown here as a general guide.
SSV SmartPay terms. Full pricing, terms, and conditions are available at ssvsmartpay.co/our-pricing. SSV SmartPay Limited is registered in England and Wales (CRN 15424021). SSV SmartPay is not directly FCA-regulated; payment initiation services are provided by FCA-authorised Payment Institution partners.
T&Cs Applied
Strong security, without the checkout friction
SSV SmartPay uses Pay by Bank, so authentication happens in your customer’s own banking app. Sign up in minutes, typically approved within 24 hours, with no monthly fees.
Start free trial Book a demo Or get in touch with the team →Frequently Asked Questions
What is Strong Customer Authentication (SCA)?
Strong Customer Authentication is a security requirement for electronic payments that asks customers to verify their identity using at least two of three independent factors: something they know, something they have and something they are. It is designed to reduce payment fraud and protect both customers and businesses.
What are the three SCA factors?
The three SCA factors are knowledge, possession and inherence. Knowledge means something the customer knows, such as a password or PIN; possession means something they have, such as a phone or card; and inherence means something they are, such as a fingerprint or facial recognition.
Does SCA apply to Pay by Bank?
Yes. With Pay by Bank, the customer approves the payment through their own banking app using their bank’s normal authentication process, such as a password, fingerprint or facial recognition. This means authentication is built directly into the payment journey.
What payments may be exempt from SCA?
Possible exemptions can include certain low-value payments, low-risk transactions, some recurring or merchant-initiated payments, trusted beneficiaries and qualifying contactless payments. The availability of an exemption depends on the transaction, payment provider and current regulatory requirements.
How does SCA work with online card payments?
Online card payments commonly use 3-D Secure to meet SCA requirements. The customer may be asked to approve the transaction through their banking app, enter a one-time code or complete another identity check.
Does SCA make the checkout process slower?
SCA can add an authentication step, but modern payment journeys can make it quick and straightforward. Pay by Bank allows customers to authenticate directly through their trusted banking app, which can reduce unnecessary checkout friction.
