Strong Customer Authentication (SCA)

Strong Customer Authentication, or SCA, is the requirement that most online card payments are verified by two independent factors - typically the card plus an approval in the bank’s app. The FCA extended the UK e-commerce deadline from 14 September 2021 to 14 March 2022 and said it expected full compliance from that date. For a shop it shows up as the bank-app step customers occasionally see at checkout.

In practice

Strong Customer Authentication means an online payment usually has to be verified by two independent factors — typically the card plus a bank app approval. The FCA moved the UK e-commerce deadline from 14 September 2021 to 14 March 2022, and from that date expected full compliance for e-commerce transactions.

For a shop it shows up as the bank-app step customers occasionally see at checkout. Done well it is invisible most of the time, because exemptions exist for low-value and repeat payments and a good payment provider applies them automatically.

Done badly it is a conversion problem: an authentication step that opens in the wrong place, or a checkout that cannot handle the customer coming back from their banking app, loses the order at the last tap. It is one of the things worth testing on a real phone rather than in a desktop browser.

Also called: SCA, 3D Secure, two factor payment.

Questions people ask about strong customer authentication (sca)

When did SCA become mandatory in the UK?

The FCA extended the deadline for e-commerce transactions to 14 March 2022, having previously moved it to 14 September 2021, and described that as the last extension it expected to give. From that date it expected full compliance, with supervisory action for firms that were not ready.

Why do some payments skip the bank-app step?

Because exemptions exist for low-value payments, repeat payments and transactions the provider assesses as low risk, and a good payment provider applies them automatically. Done well, SCA is invisible most of the time, which is the outcome to aim for rather than a step on every order.

How does SCA lose orders?

When the authentication step opens in the wrong place, or when the checkout cannot handle the customer returning from their banking app and drops the basket. It is one of the few things genuinely worth testing on a real phone with a real card rather than in a desktop browser.

Sources, checked 26 October 2026

Financial Conduct Authority, Deadline extension for Strong Customer Authentication: e-commerce deadline moved to 14 March 2022