SCA

What is SCA?

SCA (Strong Customer Authentication) is a requirement under the EU payments directive PSD2 that applies to electronic payments in the EEA. The customer must be verified with at least two of three independent factors: something they know (e.g. a code), something they have (e.g. a phone), and something they are (e.g. a fingerprint). For online card payments, SCA is usually handled through the 3D Secure 2 (3DS2) protocol, where the customer approves the purchase in their banking app.

Why does SCA matter?

If a payment requires SCA and it is not completed, the customer’s card issuer can decline the transaction with a so-called “soft decline”. For an online store, missing or poorly implemented SCA therefore means lost orders and frustrated customers at checkout. At the same time there are exemptions where SCA can be skipped — such as low-value transactions under 30 EUR and transaction risk analysis (TRA) — so a correct setup balances security against friction.

Common use cases

• Online card payments, where 3DS2 authentication is triggered by the customer’s bank.
• Exemptions like low value (under 30 EUR), TRA, and fixed recurring payments that reduce friction.
• Merchant-initiated transactions (MIT), e.g. subscriptions, which fall entirely out of scope of SCA.
• Debugging declined payments, where a “soft decline” from the issuer points to an SCA challenge.

Shopify perspective

Shopify Payments supports 3D Secure and triggers the SCA flow automatically at checkout when the customer’s bank requires it — so you do not have to code the protocol yourself. If you use a third-party payment gateway, make sure it is SCA-ready and supports 3DS2. Test with real European cards and watch declined payments in your reports so you catch banks or gateways that handle SCA incorrectly.