Does PSD2 strong customer authentication replace AVS and CVV in Europe?
No. PSD2 strong customer authentication does not replace AVS and CVV in Europe. SCA requires two independent factors, and the European Banking Authority has stated that the code printed on the card is not one of them. The CVV is still sent with most authorizations, and AVS remains a risk signal where issuers support it.
In detail
No. The checks work at different levels, and European payments use them together.
What SCA requires
Strong customer authentication needs two factors from different categories: something the user knows, something the user possesses and something the user is. The European Banking Authority’s opinion of June 2019 states that card details and the security code printed on the card are neither a possession element nor a knowledge element. A CVV match is therefore not part of SCA.
Where AVS and CVV still matter
- Authorization: the CVV is still sent with most customer-initiated payments, and issuers can decline when it does not match.
- Exemptions: many payments are exempt from SCA, for low value, low risk or merchant-initiated use. Data checks and velocity rules carry more weight there.
- Non-European cards: a buyer with a card issued outside Europe may not be authenticated. AVS is useful for US, Canadian and UK cards.
- Risk scoring: results feed the decision to request an exemption or to authenticate.
The EBA and ECB report of December 2025 shows that fraud rates are lower when SCA is applied. The coming Payment Services Regulation keeps SCA at its core, as explained in PSD3.
See AVS and CVV for the comparison. Operators combine these signals in a smart checkout.