science

Strong customer authentication

Strong customer authentication is a science topic covered in the lgStudy science library. This page brings together a partial reference excerpt, illustrations, worked examples, real-world applications and a short study plan, so you can understand Strong customer authentication rather than just read about it. In short: Strong customer authentication (SCA) is a requirement of the EU Revised Directive on Payment Services (PSD2) on payment service providers within the European Economic Area. The requirement ensures that electronic payments are performed with multi-factor authentication, to increase the security of electronic payments.

Key takeaways

Strong customer authentication belongs to science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Strong customer authentication to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Strong customer authentication from memory before moving on to harder problems.

Reference excerpt

Strong customer authentication (SCA) is a requirement of the EU Revised Directive on Payment Services (PSD2) on payment service providers within the European Economic Area. The requirement ensures that electronic payments are performed with multi-factor authentication, to increase the security of electronic payments. Physical card transactions already commonly have what could be termed strong customer authentication in the EU (Chip and PIN), but this has not generally been true for Internet transactions across the EU prior to the implementation of the requirement, and many contactless card payments do not use a second authentication factor. The SCA requirement came into force on 14 September 2019. However, with the approval of the European Banking Authority, several EEA countries have announced that their implementation will be temporarily delayed or phased, with a final deadline set for 31 December 2020.

Requirement Article 97(1) of the directive requires that payment service providers use strong customer authentication where a payer:

(a) accesses its payment account online; (b) initiates an electronic payment transaction; (c) carries out any action through a remote channel which may imply a risk of payment fraud or other abuses.

Article 4(30) defines "strong customer authentication" itself (as multi-factor authentication):

an authentication based on the use of two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is) that are independent, in that the breach of one does not compromise the reliability of the others, and is designed in such a way as to protect the confidentiality of the authentication data

Implementation The European Banking Authority published an opinion on what approaches could constitute different "elements" of SCA. 3-D Secure 2.0 can (but does not always) meet the requirements of SCA. 3-D Secure has implementations by Mastercard (Mastercard Identity Check) and Visa which are marketed as enabling SCA compliance. E-commerce merchants must update the payment flows in their websites and apps to support authentication. If authentication is not supported, many payments will be declined once SCA is fully implemented.

History On 31 January 2013, the European Central Bank (ECB) issued recommendations on Internet payment security, requiring strong customer authentication. The ECB's requirements are technologically neutral, in order to foster innovation and competition. The public submission process to the ECB identified three solutions to strong customer authentication, two of which are based on reliance authentication, and the other being the new variant of 3-D Secure which incorporates one-time passwords. Subsequently, the European Commission drafted proposals for an updated Payment Services Directive including this requirement, which became PSD2. PSD2 strong customer authentication has been a legal requirement for electronic payments and credit cards since 14 September 2019.

Criticism In 2016, Visa criticised the proposal of making strong customer authentication mandatory, on the grounds that it could make online payments more difficult, and thus hurt sales at online retailers. In 2019, consumer representation group Which? noted that many UK banks were implementing SCA by requiring a phone capable of receiving a text message or push notification. When surveyed, nearly one in five Which? members were concerned that they may be unable to make payments if there was no alternative, either due to poor reception or not owning a phone. In 2020, an independent report conducted by consultancy firm CMSPI found that the potential disruption caused by strong customer authentication (excluding the United Kingdom) could be €108 billion in 2021.

Outside Europe The Reserve Bank of India has mandated an "additional factor of authentication" for card-not-present transactions. A proposal to make 3-D Secure mandatory in Australia was blocked by the Australian Competition & Consumer Commission in 2016 after objections.

Worked examples

Example 1 — a first encounter with Strong customer authentication

Start with the simplest possible case. Write down what Strong customer authentication claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Strong customer authentication before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Strong customer authentication ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Strong customer authentication

In research: Strong customer authentication appears in science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Strong customer authentication in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Strong customer authentication is common in secondary-school and first-year university syllabi. It links to neighbouring topics Authentication methods, Banking in the European Union, European Economic Area, so understanding it makes those chapters shorter.
In everyday life: Look for Strong customer authentication outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

Affiliate

Preply — study more efficiently by working with a personal tutor. 50% off.

How to study Strong customer authentication in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Strong customer authentication means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Strong customer authentication out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Strong customer authentication in simple terms?

Why does Strong customer authentication matter?

Because it connects several science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Strong customer authentication?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Strong customer authentication.