How does strong customer authentication work?
PSD2 defines strong customer authentication as authentication based on two or more elements categorised as knowledge (something only the user knows), possession (something only the user possesses) and inherence (something the user is), which are independent of each other. The EBA’s 2019 opinion on SCA elements adds that the two elements must belong to two different categories, so a password plus a PIN is not enough. For card payments, SCA is usually delivered through 3-D Secure, with the issuer running the challenge. The regulatory technical standards, which apply from 14 September 2019, set the details and the exemptions.
Why does SCA matter for approval rate?
Because the issuer can decline a payment that arrives without it. A payment that needed authentication and did not get it comes back as a soft decline asking for SCA, and has to be retried with 3-D Secure. As an illustrative example: a merchant sends 8,000 European card payments a month without authentication, relying on exemptions. Issuers return soft declines asking for SCA on 1,200 of them. If the merchant retries those with 3-D Secure and 80% complete authentication and are approved, it recovers 960 payments; if it does not, all 1,200 are lost.
What are the trade-offs?
Every challenge adds friction and some customers abandon. Exemptions such as low-value payments and transaction risk analysis reduce challenges, but the issuer can refuse them and fraud liability usually returns to the merchant when an exemption is used. The aim is to authenticate where it is required or useful and avoid challenging the same customer twice.
Where does Omno use it?
Authentication is performed by the connected PSP. Omno’s hosted checkout carries the 3-D Secure step inside the payment flow, and the routing-decision log records the response code for each attempt, including soft declines that ask for authentication.