What is Strong Customer Authentication (SCA)?

As part of the EU's Payment Services Directive (PSD2), SCA is a requirement to boost the security of online payments. From September 14th 2019, extra levels of authentication are now required at the point of transaction.

3D Secure 2.0 is the authentication tool of choice to collect SCA information and allow transactions to complete successfully.

What this actually means is payments that require SCA will involve the customer having to provide an extra form of authentication. This is likely to be in the form of a one time passcode sent via SMS by the bank/card issuer, or verification in the customer's banking app by fingerprint/face recognition.

How will this affect my coach company?

If you take payment for coach hire bookings online, or for example sell tickets/passes for school services online, you will be affected.

Coach hire bookings

As one off payments for bookings are likely to be over €30, paying by credit/debit card online will require SCA. If your payment integration doesn't cater for this from September 14th 2019, your transactions will be declined.

School services

One off payments for items like annual or term tickets again would be impacted by SCA.

Where it gets interesting is recurring payments if your business offers this as an option (e.g. annual ticket spread over 8 payments).

Subscriptions with a static amount (e.g. £100/month) are exempt from SCA from the second payment onwards. Often however, payments are requested variably. For example, 7 payments of £100 and 1 final payment of £50, or recurring term payments with the last term of year being cheaper.

All of these scenarios would be subject to SCA, for not only subscription by credit/debit card but standing orders also.

What can I do to prevent disruption to my business?

As the time is ticking for the SCA deadline, you need to start planning for the support of SCA, and maximising SCA exemption.

Single payments

If you take card payment online, ensuring that your payment integration is ready for SCA should be a priority.

Without support in place, transactions will be declined, and you may need to fallback to another mechanism for payment handling like phone sales (exempt from SCA) or bank transfer.

Failure to have a complete solution for SCA in place is likely to increase the cost of administration, by having to offer alternative methods of payment, and potentially bring further compliance burden (PCI DSS).

Recurring payments

If you offer recurring payments via credit/debit card online, you will need to ensure that your payment integration supports SCA for at least the initial transaction. It's preferable to make recurring payments as frictionless as possible, which is why you may want to reconsider your payment model.

For example, instead of having 1 payment at £50, 6 at £100 and 1 at £50, make all payments the same (8 payments of £87.50). In this scenario, SCA would only be applied once, rather than three times. This also applies to standing orders.

Another option to consider is direct debit. As direct debit is merchant initiated it's completely exempt from SCA.