Strong Customer Authentication (SCA) requirements are fully enforced in all eligible European countries, causing a massive shift in the European payment landscape.

To meet SCA requirements, a form of two-factor authentication is required for electronic payments and access to payment accounts. Without authentication, many payments may be declined by your customers' banks. We designed foundational payments APIs to help businesses handle this change and take full advantage of any SCA exemptions. Stripe's authentication engine automatically selects the optimal authentication flow for each transaction to maximise conversion while minimising fraud.

We recommend using this guide to understand how different types of payment flows have changed due to SCA and referring to it as you design your payment flows.

How online card payments have changed

Traditional card payments usually involve two steps: authorisation and capture. A payment is authorised when a customer's bank or card issuer decides to approve a payment, and the payment is captured when the card is charged.

With SCA, there is an additional and mandatory step before authorisation and capture: authentication. This step is aimed at protecting customers by preventing fraud. To authenticate a payment, a customer responds to a prompt from their bank and provides additional information. This may be something they know, such as a password; something they use, such as their phone; or something that's part of who they are, such as their fingerprint.

The most common way to authenticate an online card payment is a method called 3D Secure. You may recognise 3D Secure by its branded names, such as "Visa Secure" or "Mastercard Identity Check". A newer version called 3D Secure 2 has become the standard method to authenticate payments. You can learn about the differences between these methods in our 3D Secure 2 guide. Our SCA-ready products all support 3D Secure 2.

No matter what method you use, customers need to be using your website or app to authenticate. Adding this step can be simpler for businesses that charge customers straight away and more complex for businesses that charge customers after they've left the checkout flow. (This is sometimes referred to as off-session.)

The scenarios in this guide offer examples of how these three steps (authentication, authorisation and capture) can vary depending on how and when you charge your customers.

Understanding exemptions

There are certain types of payments – such as low-risk transactions, fixed-amount subscriptions, phone sales and merchant-initiated transactions – that may be exempt from SCA. Merchant-initiated transactions are payments made with a saved card when the customer is off-session. Common examples include a gym membership payment or utility bill. To use this exemption, your business must have an agreement with your customer and have them authenticate their card when it's being saved or authenticate the first payment. Our Strong Customer Authentication guide goes into greater detail about these exemptions and others.

Stripe's SCA-ready payment APIs and products help businesses take full advantage of these opportunities by requesting exemptions automatically. When exemptions are accepted by your customers' banks, your customers won't have to authenticate, minimising the impact on conversion.

However, businesses must design their payment flows to authenticate customers if the exemption is declined. This is especially important because the rules around exemptions depend on your customers' banks. The banks evaluate each payment and decide whether an exemption applies – and individual banks will apply exemptions differently.

Business scenarios

To illustrate the impact and application of SCA, we’ve outlined how an authentication step can fit into payment flows for different business models.

E-commerce

One-off payment. Card not saved.

E-commerce businesses typically charge customers while they're on-session, without saving card details for future payments. If your business has a similar payment flow, adding authentication should be simple: you can authenticate with 3D Secure straight after the customer enters their card details and places their order.

Stripe automatically requests any eligible exemptions, so your customers may not need to authenticate. But because individual banks apply exemptions differently, your business still needs to design payment flows to authenticate customers when necessary.

Recommendations

Choose an option:

Ridesharing

Payment captured within seven days of authorisation. Final payment amount may change.

Ridesharing businesses and other on-demand marketplaces typically capture payments within seven days of authorisation, and the final amount may increase or decrease. If your business has a similar payment flow, you can authenticate with 3D Secure straight after the customer requests a journey, because they'll still be on-session. If the final amount ends up being more than originally authenticated, the customer would need to authenticate again for the increased amount, unless a tolerance is permitted by the regional policies allowing the amount to differ. If the final amount is less than originally authenticated, there would be no need to authenticate again.

Another way to approach this payment flow would be to authenticate and authorise for a larger amount when the customer first requests a journey. If the customer wants to add a tip later, and the total is below the authenticated amount, the customer won't need to authenticate again. The downside to this approach is that authenticating for a larger amount upfront might deter price-sensitive customers.

Recommendation

Crowdfunding

Payment captured more than seven days after authorisation.

Crowdfunding platforms typically capture payments more than seven days after authorisation. Each campaign lasts for a set length of time, and payments are captured when a campaign is successful. If your business has a similar payment flow, you can authenticate with 3D Secure when customers pledge to support a campaign, and then authorise and capture when the campaign ends successfully. If authorisation fails, your business will need to bring the customer back on-session to re-authenticate.

Successful payment

Failed payment

Recommendation

Car hire

Payment captured more than seven days after authorisation. Final payment amount may change.

Car hire companies typically capture payments more than seven days after authorisation, and the final payment amount is likely to increase or decrease because of discounts, upgrades or add-on services at pick-up or drop-off. If your business has a similar payment flow, you can split the payment into separate charges – authenticating the card with 3D Secure when it's being saved, and authorising and capturing the cost of the hire and any incidentals later on.

Recommendation

Gym membership

Recurring payments. Fixed amount.

Gym memberships are typically recurring payments with a fixed amount and the membership may begin with a free trial period.

Merchant-initiated transactions are payments made with a saved card when the customer is off-session. To qualify, your business must have an agreement with the customer and have them authenticate their card, either when it's being saved or on the first payment.

It's important to note that exemptions aren't guaranteed and subsequent payments may require authentication. Individual banks may apply exemptions differently, so your business needs to design payment flows to bring customers back on-session to re-authenticate.

Successful payment

Failed payment

Recommendations

Choose an option:

Utility bill

Metered billing. Recurring payments.

Utility bills are recurring payments with amounts likely to vary from month to month due to metered billing. If your business has a similar payment flow, 3D Secure authentication is required when a customer saves their card to set up automatic payments. To do this, the customer would complete 3D Secure authentication separately to a transaction.

It's important to note that exemptions aren't guaranteed and subsequent payments may require authentication. Individual banks may apply exemptions differently, so your business needs to design payment flows to bring customers back on-session to re-authenticate when necessary.

Payment with an exemption

Payment without an exemption

Recommendations

Choose an option: