Transaction not concerned by the SCA
The SCA (Strong Customer Authentication) is an authentication method where the buyer must pass at least two authentication factors.
The second Payment services directive (or DSP2) imposes strong authentication but also describes the cases that are not concerned by this strong authentication.
These cases are:
- Merchant initiated transactions (or “MIT”).
That is, payments made without the online presence of the buyer (payment by file, payment by server-to-server web services, duplication).
For example, when the merchant manages the installments on their own in case of a recurring payment with variable amounts and due dates.
Nevertheless, strong authentication is mandatory when registering the payment method and when making the first payment of a series of recurring payments or a payment in installments.
- VAD payments (or "MOTO" - Mail Order Telephone Order).
These are purchases initiated by post, e-mail or phone where the card data is entered by an operator.
- Transactions outside the European Economic Area (or one-leg transactions).
Where one of the payment participants, the acquirer or the issuer are not located in the European Economic Area.