Strong customer authentication will apply to “customer-initiated” online payments within europe. As a result, most card payments and all bank transfers will require SCA.Cognitive learning theory in the classroom recurring direct debits on the other hand are considered “merchant-initiated” and will not require strong authentication. With the exception of contactless payments, in-person card payments are also not impacted by the new regulation.Cognitive learning theory in the classroom

Currently, the most common way of authenticating an online card payment relies on 3D secure—an authentication standard supported by the vast majority of european cards.Cognitive learning theory in the classroom applying 3D secure typically adds an extra step after the checkout where the cardholder is prompted by their bank to provide additional information to complete a payment (e.G., a one-time code sent to their phone or fingerprint authentication through their mobile banking app).Cognitive learning theory in the classroom

Under this new regulation, specific types of low-risk payments may be exempted from strong customer authentication. Payment providers like stripe will be able to request these exemptions when processing the payment.Cognitive learning theory in the classroom the cardholder’s bank will then receive the request, assess the risk level of the transaction, and ultimately decide whether to approve the exemption or whether authentication is still necessary.Cognitive learning theory in the classroom

Building authentication into your checkout flow introduces an extra step that can add friction and increase customer drop-off. Using exemptions for low-risk payments can reduce the number of times you will need to authenticate a customer and reduce friction.Cognitive learning theory in the classroom we have designed our new SCA-ready payments products to let you take advantage of exemptions when possible to help protect your conversion.

Cognitive learning theory in the classroom

In cases, where only the payment provider’s fraud rate is below the threshold, but the cardholder’s bank is above it, we expect the bank to decline the exemption and require authentication.Cognitive learning theory in the classroom we expect this to be one of the most useful exemptions for businesses and one of the most widely supported by banks. Stripe radar’s comprehensive, real-time risk assessment allows us to support this exemption for our users.Cognitive learning theory in the classroom payments below €30

This is another exemption that can be used for payments of a low amount. Transactions below €30 will be considered “low value” and may be exempted from SCA.Cognitive learning theory in the classroom banks will however need to request authentication if the exemption has been used five times since the cardholder’s last successful authentication or if the sum of previously exempted payments exceeds €100.Cognitive learning theory in the classroom the cardholder’s bank will need to track the number of times this exemption has been used and decide whether authentication is necessary. Due to the strict limitations of this exemption, we expect the low-risk transaction exemption to be more relevant for most payments.Cognitive learning theory in the classroom we will, however, support this exemption for our users. Fixed-amount subscriptions

This exemption can apply when the customer makes a series of recurring payments for the same amount, to the same business.Cognitive learning theory in the classroom SCA will be required for the customer’s first payment—subsequent charges however may be exempted from SCA. We expect this exemption to be very useful for subscription businesses and broadly supported by european banks.Cognitive learning theory in the classroom we will enable this exemption for stripe users. If you’re using stripe billing to create subscriptions, we will automatically apply this exemption when relevant and can help manage authentication requests in case the exemption is rejected by the customer’s bank.Cognitive learning theory in the classroom merchant-initiated transactions (including variable subscriptions)

Payments made with saved cards when the customer is not present in the checkout flow (sometimes called “off-session”) may qualify as merchant-initiated transactions.Cognitive learning theory in the classroom these payments technically fall outside the scope of SCA. In practice, marking a payment as a “merchant-initiated transaction” will be similar to requesting an exemption.Cognitive learning theory in the classroom and like any other exemption, it will still be up to the bank to decide whether authentication is needed for the transaction.

To use merchant-initiated transactions, you will need to authenticate the card either when it’s being saved or on the first payment.Cognitive learning theory in the classroom finally, you will need to get an agreement from the customer (also referred to as a “mandate”), in order to charge their card at a later point.Cognitive learning theory in the classroom this will be a vital use case for business models that rely on delayed payments, charge variable amount subscriptions, or bill for add-ons. We expect it to be supported by most european banks and accepted if the transaction is considered low-risk by the bank.Cognitive learning theory in the classroom

When completing authentication for a payment, customers may have the option to whitelist a business they trust to avoid having to authenticate future purchases.Cognitive learning theory in the classroom these businesses will be included on a list of “trusted beneficiaries” maintained by the customer’s bank or payment service provider. While whitelisting has the potential to make repeat purchases or subscriptions more convenient for customers, so far the adoption of this feature among banks has been slow.Cognitive learning theory in the classroom we expect that it will not be broadly implemented by banks by september 2019, but we will support this exemption for our users when available.Cognitive learning theory in the classroom phone sales

Card details collected over the phone fall outside the scope of SCA and do not require authentication. This type of payment is sometimes referred to as “mail order and telephone orders” (MOTO).Cognitive learning theory in the classroom marking a payment as being a MOTO transaction will be similar to requesting other exemptions, with the cardholder’s bank making the final decision to accept or reject the transaction.Cognitive learning theory in the classroom we are working with regulators and the wider industry to determine how best to support this use case for our users. Sign up below to be notified as soon as this use case is supported.Cognitive learning theory in the classroom corporate payments

This exemption may cover payments that are made with “lodged” cards (e.G., where a corporate card used for managing employee travel expenses is held directly with an online travel agent), as well as corporate payments made using virtual card numbers (which are also used in the travel sector).Cognitive learning theory in the classroom we expect this exemption to have low practical use outside of the travel industry due to its very narrow scope. The exemption itself can only be requested by the cardholder’s bank, as neither the business, nor payment providers (like stripe) are able to detect whether a card belongs in these categories.Cognitive learning theory in the classroom what happens if an exemption fails?

While exemptions will be very useful, it’s important to remember that it’s ultimately the cardholder’s bank that will decide whether or not to accept an exemption.Cognitive learning theory in the classroom banks will return new decline codes for payments that failed due to missing authentication. These payments will then have to be resubmitted to the customer with a request for strong customer authentication.Cognitive learning theory in the classroom stripe’s SCA-ready products will automatically trigger this extra authentication when required by banks.

If your business is impacted by SCA, we recommend preparing for a fallback in case an exemption is rejected and your customer needs to authenticate.Cognitive learning theory in the classroom this is particularly important if you charge your customers when they’re not actively in your checkout flow (when they are off-session) and your customer needs to return to your website or app to authenticate.Cognitive learning theory in the classroom read our guide on designing payment flows for SCA for more information. How stripe helps you prepare for strong customer authentication

In addition to supporting new authentication methods like 3D secure 2, we believe successful handling of exemptions will become a key component for building a first-class payments experience that minimises friction.Cognitive learning theory in the classroom we expect there will be differences in how national regulators and even individual banks will support exemptions and are building solutions to help manage this complexity for you.Cognitive learning theory in the classroom