SCA (strong customer authentication)

SCA (strong customer authentication) is the requirement, introduced by the European PSD2 directive, to authenticate a customer using at least 2 independent factors drawn from 3 categories: knowledge (a password), possession (a phone) and inherence (biometrics). It applies in particular to online payments and to access to payment accounts. Exemptions exist for low-value transactions or trusted beneficiaries. Its purpose is to reduce payment fraud and account takeover.