SCA (Strong Customer Authentication)

SCA (Strong Customer Authentication) is the European regulatory requirement, introduced by the second Payment Services Directive (PSD2), that electronic card payments be authenticated using at least two of three independent factors: something the cardholder knows (a password or PIN), something they possess (a phone or hardware token), and something they are (a fingerprint or face scan). In practice SCA is delivered through 3-D Secure 2, the challenge screen a guest sees when their bank asks them to confirm a booking in their banking app. The UK operates an equivalent regime under its own retained PSD2 rules.

Where it applies in hotel distribution

SCA is triggered when both the cardholder's bank and the merchant's acquirer are in the European Economic Area, which makes it primarily a European distribution concern. It bites unevenly across the booking stack:

• Prepaid and non-refundable rates charged at booking are authenticated in the flow, where the guest is present to complete the challenge.
• Book-now-pay-later reservations are the harder case. The card is stored for a charge that will happen weeks later with no cardholder present, so the merchant must obtain an authenticated mandate at booking time in order to process the later charge as a merchant-initiated transaction.
• No-show and late-cancellation charges depend entirely on that mandate existing. Without it, the charge is exposed to a soft decline or a chargeback.
• VCC settlements from OTAs are typically out of scope, because the OTA is the merchant of record and the card is charged by the hotel as a business-to-business transaction.

Exemptions

Several exemptions let a merchant request that the challenge be skipped, though the issuing bank makes the final call: low-value transactions under €30 (subject to cumulative limits), transaction risk analysis for low-risk payments at acquirers with strong fraud performance, merchant-initiated transactions backed by a prior authenticated mandate, and MOTO (mail order / telephone order) payments, which fall outside SCA entirely but carry higher fraud liability.

Why it matters

SCA converted card handling from an operational detail into a distribution design problem. Hotels that did not implement an authenticated card-on-file mandate found that their cancellation policies were, in effect, unenforceable — the policy existed but the charge failed. It also introduced measurable friction into the direct booking flow at exactly the point of conversion, which is one reason abandonment analysis and funnel drop-off tracking became standard for European direct channels. Booking engines and payment providers now compete substantially on how invisibly they handle SCA, since a well-implemented exemption strategy authenticates fewer guests while keeping liability shifted to the issuer.

Related

• VCC (Virtual Credit Card) — the OTA settlement instrument that sits largely outside SCA
• Chargeback — the downstream risk when authentication is missing
• No-show — the charge most often broken by a missing mandate
• Booking Engine — where SCA is implemented on the direct channel