Strong Customer Authentication (SCA) requirements are fully enforced in all eligible European countries, causing a massive shift in the European payment landscape.

To meet SCA requirements, a form of two-factor authentication is required for electronic payments and access to payment accounts. Without authentication, many payments may be declined by your customers’ banks. We designed foundational payments APIs to help businesses handle this change and take full advantage of any SCA exemptions. Stripe’s authentication engine automatically selects the optimal authentication flow for each transaction to maximize conversion while minimizing fraud.

We recommend using this guide to understand how different types of payment flows have changed due to SCA and to reference it as you design your payment flows.

How online card payments have changed

Traditional card payments usually involve two steps: authorization and capture. A payment is authorized when a customer's bank or card issuer decides to approve a payment, and the payment is captured when the card is charged.

With SCA, there is an additional and mandatory step before authorization and capture: authentication. This step is aimed at protecting customers by preventing fraud. To authenticate a payment, a customer responds to a prompt from their bank and provides additional information. This may be something they know, like a password, something they use, like their phone, or something that's part of who they are, like their fingerprint.

The most common way to authenticate an online card payment is a method called 3D Secure. You may recognize 3D Secure by its branded names, such as “Visa Secure” or “Mastercard Identity Check.” A newer version called 3D Secure 2 has become the standard method to authenticate payments. You can learn about the differences between these methods in our 3D Secure 2 guide. Our SCA-ready products all support 3D Secure 2.

No matter what method you use, customers need to be using your website or app to authenticate. Adding this step can be simpler for businesses that charge customers right away, and more complex for businesses that charge customers after they’ve left the checkout flow. (This is sometimes called off-session.)

The scenarios in this guide offer examples of how these three steps (authentication, authorization, and capture) can vary depending on how and when you charge your customers.

Understanding exemptions

There are certain types of payments—such as low-risk transactions, fixed-amount subscriptions, phone sales, and merchant-initiated transactions—that may be exempt from SCA. Merchant-initiated transactions are payments made with a saved card when the customer is off-session. Common examples include a gym membership payment or utility bill. To use this exemption, your business must have an agreement with your customer and have them authenticate their card when it’s being saved or authenticate the first payment. Our Strong Customer Authentication guide goes into greater detail about these exemptions and others.

Stripe’s SCA-ready payment APIs and products help businesses take full advantage of these opportunities by automatically requesting exemptions. When exemptions are accepted by your customers’ banks, your customers won’t have to authenticate, minimizing the impact on conversion.

However, businesses must design their payment flows to authenticate customers if the exemption is declined. This is especially important because the rules around exemptions depend on your customers’ banks. The banks evaluate each payment and decide whether an exemption applies—and individual banks will apply exemptions differently.

Business scenarios

To illustrate the impact and application of SCA, we’ve outlined how an authentication step can fit into payment flows for different business models.

Ecommerce

One-time payment. Card not saved.

Ecommerce businesses typically charge customers while they’re on-session, without saving card details for future payments. If your business has a similar payment flow, adding authentication should be simple: you can authenticate with 3D Secure right after the customer enters their card details and places their order.

Stripe automatically requests any eligible exemptions, so your customers may not need to authenticate. But because individual banks apply exemptions differently, your business still needs to design payment flows to authenticate customers when necessary.

Recommendations

Choose an option:

Ridesharing

Payment captured within seven days of authorization. Final payment amount may change.

Ridesharing businesses and other on-demand marketplaces typically capture payments within seven days of authorization, and the final amount may increase or decrease. If your business has a similar payment flow, you can authenticate with 3D Secure right after the customer requests a ride, because they’ll still be on-session. If the final amount ends up being more than originally authenticated, the customer would need to authenticate again for the increased amount, unless a tolerance is permitted by the regional policies allowing the amount to differ. If the final amount is less than originally authenticated, there would be no need to authenticate again.

Another way to approach this payment flow would be to authenticate and authorize for a larger amount when the customer first requests a ride. If the customer wants to add a tip later, and the total is below the authenticated amount, the customer won’t need to authenticate again. The downside to this approach is that authenticating for a larger amount up front might deter price-sensitive customers.

Recommendation

Crowdfunding

Payment captured more than seven days after authorization.

Crowdfunding platforms typically capture payments more than seven days after authorization. Each campaign lasts for a set length of time, and payments are captured when a campaign is successful. If your business has a similar payment flow, you can authenticate with 3D Secure when customers pledge to support a campaign, and then authorize and capture when the campaign ends successfully. If authorization fails, your business will need to bring the customer back on-session to re-authenticate.

Successful payment

Failed payment

Recommendation

Car rental

Payment captured more than seven days after authorization. Final payment amount may change.

Car rental companies typically capture payments more than seven days after authorization, and the final payment amount is likely to increase or decrease because of discounts, upgrades, or add-on services at pickup or dropoff. If your business has a similar payment flow, you can split the payment into separate charges—authenticating the card with 3D Secure when it’s being saved, and authorizing and capturing the cost of the rental and any incidentals later on.

Recommendation

Gym membership

Recurring payments. Fixed amount.

Gym memberships are typically recurring payments with a fixed amount, and the membership may begin with a free trial period.

Merchant-initiated transactions are payments made with a saved card when the customer is off-session. To qualify, your business must have an agreement with the customer and have them authenticate their card, either when it’s being saved or on the first payment.

It’s important to note that exemptions aren’t guaranteed, and subsequent payments may require authentication. Individual banks may apply exemptions differently, so your business needs to design payment flows to bring customers back on-session to re-authenticate.

Successful payment

Failed payment

Recommendations

Choose an option:

Utility bill

Metered billing. Recurring payments.

Utility bills are recurring payments with amounts likely to vary from month to month due to metered billing. If your business has a similar payment flow, 3D Secure authentication is required when a customer saves their card to set up automatic payments. To do this, the customer would complete 3D Secure authentication outside of a transaction.

It’s important to note that exemptions aren’t guaranteed, and subsequent payments may require authentication. Individual banks may apply exemptions differently, so your business needs to design payment flows to bring customers back on-session to re-authenticate when necessary.

Payment with an exemption

Payment without an exemption

Recommendations

Choose an option: