Skip to content
Create account
or
Sign in
The Stripe Docs logo
/
Ask AI
Create account
Sign in
Get started
Payments
Finance automation
Platforms and marketplaces
Money management
Developer tools
Get started
Payments
Finance automation
Get started
Payments
Finance automation
Platforms and marketplaces
Money management
OverviewExplore all products
Start building
Start developing
Sample projects
About the APIs
Building with LLMs
Use Stripe without code
Set up Stripe
Create an account
Products and prices
Web Dashboard
Mobile Dashboard
Migrate to Stripe
Migrate customer data
Migrate payment data
Migrate subscriptions
Manage fraud risk
Understand fraud
Radar fraud protection
Manage disputes
Verify identities
Regulatory support
    Co-badged cards compliance
    SCA readiness
      Plugins
      Previous authorization agreements
      SCA enforcement
    India recurring payments
HomeGet startedRegulatory supportSCA readiness

SCA enforcement

Learn how European regulators enforce Strong Customer Authentication (SCA).

Copy page

Although Europe is phasing it in unevenly, you should prepare your payment flows to be ready for SCA as soon as possible if SCA regulations impact you. Preparing for SCA helps prevent an increase in declines from European cards, and prepares you in case of early enforcement by banks. Read more about how enforcement varies by country.

Make sure your integration is SCA-ready

Your integration is SCA-ready when you process all of your payments volume using SCA-ready products. Your business must use an SCA-ready product, such as a recent version of Stripe Checkout, Billing, the Payment Intents API, or an SCA-ready partner solution. Additionally, you should:

  • Test 3D Secure (3DS) authentication thoroughly. Use our regulatory test cards to ensure that your integration can handle 3DS.
  • For off-session payments, make sure you set up and authenticate the card when saving the payment method, and use the API to flag off-session payments.
  • If your business uses the Stripe Billing Subscriptions or Invoice APIs, make sure your integration can handle incomplete statuses.

Understand incomplete, declined, or failed payments

Payments can be unsuccessful for a number of reasons, including incomplete, declined, or failed payments. If you look in the Dashboard and see that your payments aren’t advancing past the incomplete status (requires_action in the API):

  • Make sure that your customer isn’t in the process of authenticating. If they’re authenticating and it’s an on-session payment, they may expect to see this. It’s also possible that they’ve abandoned the checkout flow.
  • Check that you’re handling next actions such as authentication—next actions failures can also cause payments to fail.
  • For off-session payments, set off_session to true when creating the payment.

Banks can decline payments that require 3DS authentication but don’t have 3DS enabled. Go to the Dashboard to see which payments were declined for this reason. For off-session payments, filter by failed payments in the Dashboard. Hovering over the status badge highlights the decline reason (for example, authentication required). You can view on-session payments by applying the incomplete payments filter and seeing if the payment is incomplete, since it requires authentication.

You may see off-session payments failing even though you think they’re exempt from SCA requirements. For off-session payments, make sure that you’re authenticating the card when saving card details, either without a payment or during a payment. When saving cards without a payment, use the Setup Intents API and set usage to off_session. When saving cards during a payment, set setup_future_usage to off_session. Finally, be aware that exemptions aren’t guaranteed and off-session payments may still require authentication by the bank.

Monitor disputes

When monitoring disputes, be aware that payments successfully authenticated through 3DS fall under the liability shift rule. If a cardholder disputes a 3D Secure payment as fraudulent, the liability typically shifts from you to the card issuer. If the card issuer applies exemptions, the payment isn’t authenticated through 3D Secure, and liability shift doesn’t apply.

Collect permission to reuse cards

When you set up your payment flow to properly save a card with the Payment Intents or Setup Intents API, Stripe marks any subsequent off-session payment as a merchant-initiated transaction (MIT) to reduce the need to authenticate. Merchant-initiated transactions require an agreement (also known as a mandate) between you and your customer. Add terms to your website or application on how you plan to process payments that your customer can opt into. At a minimum, make sure that your terms cover the following:

  • The customer’s permission for you to initiate a payment or a series of payments on their behalf
  • The anticipated frequency of payments (that is, one-time or recurring)
  • How you determine the payment amount

Add text in your checkout flow that references the terms of the payment, for example: I authorize [your business name] to send instructions to the financial institution that issued my card to take payments from my card account in accordance with the terms of my agreement with you.

Use SCA-ready Stripe plugins

If you’re searching for an SCA-ready plugin, refer to Stripe Partners. If you want to migrate an existing Stripe plugin or developer library to support SCA, refer to the SCA migration guide for plugins and developer libraries.

See also

  • SCA readiness
Was this page helpful?
YesNo
Need help? Contact Support.
Join our early access program.
Check out our changelog.
Questions? Contact Sales.
LLM? Read llms.txt.
Powered by Markdoc