What is the difference between 3-D Secure and SCA?
SCA is the legal requirement under PSD2: two authentication factors for customer-initiated online payments in the EEA and the UK. 3-D Secure is the card protocol that carries it between merchant and issuer. You can meet SCA without 3DS, for example with a wallet, but 3DS is how most card payments do it.
In detail
SCA is the legal requirement under PSD2: two authentication factors for customer-initiated online payments in the EEA and the UK. 3-D Secure is the card protocol that carries it between merchant and issuer. You can meet SCA without 3DS, for example with a wallet, but 3DS is how most card payments do it.
What is 3-D Secure, and what is SCA?
Under PSD2 and the regulatory technical standards of Delegated Regulation 2018/389, a customer-initiated electronic payment inside the EEA must be authenticated with two of three factors: something the customer knows, has or is. The UK kept the same rules after Brexit, under FCA supervision.
What are the SCA exemptions?
Two cases fall outside SCA altogether rather than being exempted. Merchant-initiated transactions (MIT), such as a variable subscription charge or a hotel’s final bill, are not customer-initiated, so no SCA applies after the initial mandate. And a payment where either the issuer or the acquirer sits outside the EEA is out of scope; the issuer applies “best efforts”.
More detail in our #PayDecoding episode on 3-D Secure.