Strong Customer Authentication and 3D Secure: A Complete Guide for UK Businesses (2026)
A complete guide to Strong Customer Authentication and 3D Secure for UK businesses, including SCA exemptions, recurring payments, failed authentication and online payment security.
Updated: August 2026
Table of Contents
Introduction
Strong Customer Authentication, or SCA, is now an important part of accepting online payments in the UK. If a customer has ever been asked to approve a purchase through their banking app, enter a one-time passcode or verify their identity during checkout, they have probably experienced it.
For businesses, SCA is about balancing payment security with a smooth customer experience. Too little authentication can increase fraud and declined payments, while unnecessary checks can create friction and lost sales.
This guide explains how Strong Customer Authentication and 3D Secure work, when SCA applies, the exemptions available and how businesses can reduce authentication problems while accepting online payments securely.
What is Strong Customer Authentication?
Strong Customer Authentication is a security requirement used to verify the identity of someone making an electronic payment or accessing certain payment account services.
In the UK, the requirements are set out through payment services legislation and associated regulatory technical standards. The Financial Conduct Authority’s guidance on Strong Customer Authentication provides the regulatory background for businesses and payment providers. SCA generally requires authentication using at least two independent elements. These are based on something the customer knows, something they possess or something they are.
A password or PIN could be something they know. Their registered mobile phone could be something they possess, while a fingerprint or facial recognition can provide a biometric factor.
The important point for businesses is that entering card details alone does not necessarily provide sufficient authentication. For online card payments, additional technology may be needed to establish that the customer is genuinely authorised to use the card. This is where 3D Secure becomes important.
What is 3D Secure?
3D Secure, commonly shortened to 3DS, is an authentication protocol used for online card payments. It allows information to be exchanged between the merchant, payment provider, card network and customer’s issuing bank. The issuer can then assess the transaction and decide whether additional customer authentication is needed.
Customers may recognise this as the point during checkout where their bank asks them to approve a payment. Modern EMV 3-D Secure is considerably more sophisticated than older versions. Instead of automatically interrupting every purchase, it can support risk-based authentication and allow lower-risk transactions to proceed without an additional customer challenge.
For businesses, that makes 3D Secure both a security tool and an important part of the checkout experience.
What is The Difference Between SCA and 3D Secure?
Strong Customer Authentication and 3D Secure are closely connected, but they are not the same thing. SCA is the regulatory requirement. 3D Secure is one of the main technologies used to authenticate online card payments and help meet that requirement.
This distinction matters because SCA does not mean every customer must see a 3D Secure pop-up or enter a code. Modern 3D Secure can authenticate some transactions without any additional action from the customer. Certain transactions can also qualify for SCA exemptions.
The objective is not to challenge every payment. It is to apply the right level of authentication based on the transaction.
Table: SCA vs 3D Secure
| Strong Customer Authentication (SCA) | 3D Secure (3DS) | |
|---|---|---|
| What is it? | A regulatory authentication requirement | A technology used to authenticate online card payments |
| Main purpose | Reduce payment fraud and verify customers | Help card issuers authenticate cardholders |
| Where is it used? | Certain electronic payments | Mainly online card payments |
| Does the customer always take action? | No | No, 3DS can be frictionless |
| Can exemptions apply? | Yes | 3DS can form part of a payment journey where exemptions are considered |
| Who is involved? | Merchants, payment providers and banks | Merchant, gateway, acquirer, card scheme and issuing bank |
| Common customer experience | Banking app approval, biometrics or another authentication method | Frictionless approval or a 3DS challenge |
How Does 3D Secure Work?
When a customer attempts an online card payment, information about the transaction can be sent through the 3D Secure authentication process. The customer’s issuing bank uses that information to assess the payment. Depending on the level of risk and other factors, the transaction can broadly follow a frictionless flow or a challenge flow.
With a frictionless flow, the issuer has enough information to authenticate the transaction without asking the customer to do anything else. The customer may simply enter their card details and complete checkout normally. With a challenge flow, additional verification is required. The customer might approve the purchase through their banking app, enter a one time passcode or use another authentication method provided by their bank.
This happens quickly, but there are several organisations working behind the scenes to complete the authentication. It is also important to understand that authentication and authorisation are separate.
Passing 3D Secure confirms that the customer has successfully completed the required authentication. The issuing bank can still decline the actual payment afterwards because of insufficient funds, account restrictions or another reason.
Businesses wanting to understand the wider transaction journey can link here to your payment processors and acquiring banks guide.
What is Frictionless 3D Secure?
Frictionless authentication is one of the most important developments in modern 3D Secure. Instead of challenging the customer automatically, information surrounding the transaction is used to help the issuing bank assess whether additional verification is necessary.
If the issuer has sufficient confidence in the transaction, authentication can take place without interrupting checkout. This is valuable for e-commerce businesses because unnecessary authentication can increase checkout abandonment. Customers generally want payment to be as quick as possible, particularly when purchasing through a mobile device.
The aim is therefore not to remove security. It is to make authentication less intrusive when the transaction presents a lower risk.
EMVCo’s 3-D Secure resources provide useful technical background on how the modern protocol supports risk-based authentication
Why Doesn't Every Online Payment Require SCA?
Not every online payment results in the customer completing Strong Customer Authentication. There are several reasons for this. Some transactions can qualify for exemptions. Others may be treated differently because of the way the payment was initiated. A customer can also be authenticated through a frictionless 3D Secure flow without actively completing a challenge.
The UK’s SCA framework recognises that requiring additional authentication for every payment would create unnecessary friction. However, businesses should not assume that an exemption guarantees a payment will avoid authentication.
The customer’s issuing bank still plays an important role in deciding whether additional verification is required.
What Are SCA Exemptions?
Strong Customer Authentication exemptions allow certain qualifying transactions to proceed without the normal SCA requirement being applied. These exemptions are designed to balance payment security with convenience. Transactions considered lower risk do not necessarily need the same authentication journey as higher-risk payments.
For merchants, however, exemptions are not simply a way of switching authentication off. The payment provider, acquirer and issuing bank can all influence how the transaction is handled. The circumstances of the payment also need to meet the relevant requirements.
Some exemptions are particularly important for ecommerce and subscription businesses.
Low Value Payment Exemption
Certain low value remote electronic payments can qualify for an exemption from SCA.
Under the current UK technical standards, the individual remote transaction must not exceed £25. There are also cumulative controls limiting how many qualifying transactions can take place before authentication is required again.
This means a £10 online purchase will not automatically avoid authentication every time. The customer’s bank can still request SCA depending on previous transactions and its assessment of the payment.
Businesses should therefore think of the low-value exemption as a way of reducing unnecessary authentication rather than a guarantee that small payments will never be challenged
Transaction Risk Analysis
Transaction Risk Analysis, commonly known as TRA, allows qualifying payment service providers to assess whether a remote transaction presents a sufficiently low risk.
Rather than looking only at the purchase value, the assessment can consider information such as transaction history, spending patterns, device information and unusual payment behaviour.
Where the relevant requirements are satisfied, an exemption from SCA may be possible. This demonstrates why the quality of your payment infrastructure matters.
Online payment performance is not simply determined by the transaction rate charged by your provider. Fraud tools, transaction data, authentication and issuer relationships can all influence whether legitimate payments successfully complete.
Trusted Beneficiaries
Customers can sometimes designate particular businesses or payees as trusted beneficiaries through their payment provider.
Once the relationship has been securely established, later payments to that trusted beneficiary may potentially qualify for an SCA exemption. Authentication is still required when the customer creates or changes the trusted beneficiary list.
This exemption is less directly controlled by most ecommerce businesses, but it illustrates the principle behind SCA exemptions. Where sufficient trust has already been established, repeated authentication may not always be necessary.
Recurring Payments and SCA
Recurring payments require different consideration because repeatedly authenticating the same customer can undermine the convenience of subscription billing.
For example, someone paying £20 every month for the same service should not necessarily have to return to the merchant’s website every month to approve the payment.
For qualifying recurring transactions involving the same amount and payee, SCA can be applied when the series is first established. Later transactions in that series can then potentially proceed without SCA being applied each time.
The initial payment setup is therefore particularly important. Businesses need a payment gateway capable of correctly handling recurring transactions and storing the relevant payment credentials securely.
If recurring billing forms a major part of your business model, this is a natural place to internally link to your Payment Gateways for Subscription Businesses guide. Your existing guide already covers recurring billing, tokenisation and subscription payment infrastructure in detail
Merchant Initiated Transactions
Merchant initiated transactions, usually shortened to MITs, occur when a merchant initiates a payment using previously stored credentials under an existing agreement with the customer.
The customer is not actively participating in that particular payment. This can apply to certain subscriptions, variable billing arrangements and other situations where a customer has agreed that a business can charge their stored card later.
Qualifying merchant initiated transactions can fall outside the normal SCA requirement because the customer is not actively initiating the subsequent transaction. However, businesses cannot simply classify a transaction as merchant initiated to avoid authentication.
There needs to be an appropriate agreement with the customer and the original payment credentials need to have been established correctly. This makes the payment gateway and initial checkout configuration particularly important for businesses using stored cards.
3D Secure and Card Not Present Payments
3D Secure is primarily relevant to ecommerce and other remote card payment scenarios where the cardholder is not physically presenting their card to a payment terminal. These transactions are generally known as card-not-present or CNP payments.
Card not present payments carry additional fraud considerations because the merchant cannot physically verify the card or customer during the transaction. Authentication tools such as 3D Secure can therefore help payment providers and issuing banks establish greater confidence that the person making the payment is authorised to use the card.
This section gives you a very natural internal link to your Card Not Present Payments Explained guide. That article already discusses online, telephone and recurring CNP transactions, so the two pages should support each other rather than duplicate each other.
3D Secure and Apple Pay or Google Pay
Digital wallets can create a different authentication journey from manually entering card details into an online checkout.
Services such as Apple Pay and Google Pay can already incorporate strong authentication through the customer’s device. For example, the customer may use facial recognition, a fingerprint or their device passcode when approving the payment. This can make digital wallets attractive for e-commerce businesses because authentication can happen as part of a familiar payment experience rather than through a separate process.
For merchants, the important point is that wallet payments and manually entered card payments should not always be expected to follow the same authentication journey.
Supporting a range of secure payment methods can also give customers another way to complete their purchase if they encounter problems using a particular card.
What is a Soft Decline?
A soft decline occurs when a payment cannot initially be authorised but may potentially succeed if the merchant takes further action. In an SCA context, this can happen when the customer’s issuing bank requires additional authentication.
Instead of treating the transaction as permanently declined, a properly configured payment integration can recognise that the customer needs to authenticate.
The customer can then be taken through the appropriate 3D Secure process before the payment is attempted again. This is different from a hard decline, where simply retrying the same transaction is unlikely to solve the underlying problem.
For e-commerce businesses, handling soft declines properly can help recover legitimate payments that might otherwise be lost.
Why Do Genuine 3D Secure Payments Fail?
Not every failed 3D Secure payment is fraudulent. A genuine customer can fail authentication for several reasons. They may enter a one time passcode incorrectly, fail to approve the payment through their banking app or allow the authentication session to expire.
Technical problems can also occur. The customer may have trouble moving between the merchant’s website and banking application, particularly on mobile. An authentication window may fail to load correctly or the checkout may not process the response as expected.
Businesses experiencing high online payment failure rates should therefore avoid treating every unsuccessful payment as the same problem. Issuer declines, authentication failures, abandoned authentication and technical errors can all result in lost sales, but they require different solutions.
What Happens When a Customer Fails Authentication?
If the customer cannot successfully complete the required authentication, the merchant generally cannot simply bypass the process and force the transaction through. The next step depends on why authentication failed.
The customer may be able to try again, use another card or choose a different payment method. In some cases, they may need to contact their card issuer.
The quality of the merchant’s error message matters. A generic “payment failed” message gives the customer little idea what happened. Explaining that their bank could not authenticate the payment and offering another payment method can provide a much better customer experience.
Does 3D Secure Prevent Chargebacks?
3D Secure can provide valuable protection against certain types of fraudulent payment disputes, but it does not eliminate chargebacks.
Where the relevant conditions are met, successfully authenticated transactions can benefit from liability protection for certain fraud-related disputes under card scheme rules. However, authentication only addresses one aspect of a transaction.
A customer can still dispute a payment because goods were not delivered, a service was not provided, a refund was not processed or the purchase was allegedly different from what was advertised. Businesses still need good customer service, clear refund policies, accurate order records and appropriate chargeback management.
3D Secure should therefore be viewed as part of a wider fraud prevention strategy rather than complete chargeback protection.
How Can 3D Secure Affect Conversion Rates?
Every additional step in an online checkout creates another opportunity for a customer to leave. If someone needs to find their phone, open their banking application, log in, approve the transaction and return to the merchant’s website, some customers will abandon the purchase.
This is one reason frictionless 3D Secure is so valuable. When sufficient information allows the issuer to authenticate the transaction without an additional challenge, the business can benefit from increased security without unnecessarily interrupting the customer.
Trying to remove 3D Secure completely is not the answer either. Payments can be declined when authentication is required but has not been completed. Businesses may also lose some of the fraud protection associated with properly authenticated transactions.
The objective should be to reduce unnecessary friction while making sure authentication works properly when it is required.
Why Payment Acceptance Rates Matter
Businesses often compare payment providers by looking primarily at transaction fees. Cost is important, but it is not the only factor that affects the commercial performance of an online payment setup.
Imagine two gateways processing the same £500,000 of attempted transactions each month. If one consistently allows a higher proportion of genuine customers to complete payment successfully, the difference can potentially be worth far more than a small saving in the headline processing rate.
Authentication is only one factor affecting acceptance rates, but it is an important one. Poorly handled soft declines, excessive challenges or technical problems during authentication can all contribute to legitimate payments being lost.
As an ecommerce business grows, understanding why payments fail can therefore become just as important as understanding what each transaction costs.
Who is Responsible for SCA?
Several organisations can be involved in a single online card transaction. The merchant needs a checkout capable of supporting the required authentication journey. The payment gateway and processor transmit payment and authentication information, while the acquiring bank connects the merchant into the wider card payment infrastructure.
The card network provides the framework through which the transaction travels, while the customer’s issuing bank plays a major role in authentication and ultimately decides whether to authorise the payment.
This is why two customers purchasing the same product from the same website can have completely different experiences. One might complete checkout without noticing any authentication at all. Another might be asked to approve the payment through their banking application.
The merchant cannot control every issuer decision, but it can make sure its payment infrastructure handles those decisions correctly.
How Should Businesses Configure Online Checkout?
Most businesses should not attempt to manually decide whether individual transactions require 3D Secure. A modern payment gateway should handle much of this automatically. However, merchants still need to make sure their payment integration is correctly configured and kept up to date.
Businesses using platforms such as WooCommerce should make sure their gateway integration supports modern authentication requirements. You already have a dedicated WooCommerce payment gateway guide that could be linked naturally here. Custom e-commerce platforms require even more attention.
The checkout needs to recognise when authentication is required, present the correct customer journey and continue processing the transaction after authentication has been completed.
Businesses storing cards for later use should also make sure future recurring or merchant initiated transactions are configured correctly from the initial customer interaction.
Strong Customer Authentication and PCI DSS
SCA and PCI DSS both relate to payment security, but they serve different purposes. Strong Customer Authentication focuses primarily on verifying the identity of the person making certain electronic payments.
PCI-DSS focuses on protecting cardholder data and the systems used to store, process or transmit it. Meeting SCA requirements therefore does not make a business PCI compliant, and PCI compliance does not remove the need for appropriate customer authentication.
Businesses accepting card payments should understand both. This gives you another strong internal link to your PCI Compliance UK guide, which already references SCA and 3D Secure as part of the wider payments security landscape
How To Troubleshoot 3D Secure Failures
If your business is experiencing unusually high levels of 3D Secure failures, start by finding out where customers are dropping out. Look at the information available through your payment gateway or processor. Try to separate ordinary card declines from authentication failures and abandoned challenges, then test the customer journey yourself.
Check desktop and mobile checkout. Make sure customers return to your website correctly after using their banking application and review the messages displayed when authentication fails.
If you use recurring billing, check that subsequent transactions are correctly identified and linked to the original customer agreement.
Businesses processing significant online volumes should also speak to their payment provider about authentication performance. Providers may have access to more detailed response codes and data than are visible within the ecommerce platform.
The important thing is to diagnose the reason rather than repeatedly retrying failed payments.
What Should You Ask a Payment Provider About 3D Secure?
Businesses do not need to become experts in the technical specifications behind EMV 3DS. Your payment provider should manage much of the complexity. However, businesses that depend heavily on online payments should understand how their provider handles authentication.
Ask whether the gateway supports modern 3D Secure and how transactions requiring SCA are managed. Find out how the platform deals with soft declines and whether appropriate exemptions can be handled automatically.
Subscription businesses should also ask how stored credentials, recurring payments and merchant initiated transactions are treated. Reporting is particularly important.
Being able to identify authentication failures separately from ordinary issuer declines gives businesses much better information when trying to improve online payment acceptance.
How Payments World Can Help
Strong Customer Authentication is only one part of an effective online payment setup. The payment gateway, processor, acquiring bank, fraud controls, settlement arrangements and checkout integration can all affect how successfully a business accepts payments.
Payments World works with multiple payment providers and acquiring banks rather than offering a single payment solution. This allows us to consider how your business actually takes payments, including online turnover, average transaction values, recurring billing, existing ecommerce systems and the payment features you require.
For businesses already accepting online payments, reviewing the wider setup can also identify whether cost, gateway functionality, settlement or payment performance could be improved.
The cheapest advertised processing rate is not always the best payment solution. A reliable setup needs to combine competitive pricing with secure authentication, good payment acceptance, useful reporting and technology that works properly with your business.
Conclusion
Strong Customer Authentication is now a standard part of accepting card payments online, but when it works properly, most customers should barely notice it. The real challenge for businesses is finding the right balance between security and a smooth checkout. Too much friction can lead to abandoned purchases, while poorly configured authentication can cause genuine transactions to fail unnecessarily.
As online sales grow, it becomes increasingly important to understand why payments are being declined and whether your gateway, 3D Secure setup and acquiring arrangement are helping or hindering payment acceptance.
Ultimately, SCA should protect the transaction without getting in the customer’s way. The right payment setup should make it easy for genuine customers to pay while giving your business the security and fraud protection it needs.
If you are reviewing your online payments or experiencing problems with declined transactions, 3D Secure or your current payment gateway, contact Payments World to compare suitable payment providers and find the right setup for your business.
Like this article? For more useful guides like this on payment processing, check out our blog page here.
Frequently Asked Questions
FAQs
Strong Customer Authentication is required for certain electronic payments in the UK, although exemptions and exclusions can apply. For online card payments, 3D Secure is commonly used to help meet SCA requirements.
No. Strong Customer Authentication is a regulatory requirement, while 3D Secure is an authentication protocol used by the card payments industry to help verify customers and meet SCA requirements for online transactions.
Modern 3D Secure supports risk-based authentication. Some transactions can be authenticated without any additional action from the customer, while others may require approval through a banking app, one-time passcode or another verification method. SCA exemptions can also apply to certain transactions.
Yes. Authentication and payment authorisation are separate processes. A customer can successfully complete 3D Secure authentication but still have their payment declined by their issuing bank for reasons such as insufficient funds, account restrictions or other risk controls.
Compare payments in minutes
ready for a new payment provider? Join Us Today
Price comparison for businesses who want to save money on their finances. No callbacks. No Sales pitch. Just pricing.
