Strong customer authentication and where transactions go missing
SCA cut fraud but created a new category of decline. How to spot those and reduce them.
Since PSD2 introduced strong customer authentication, most card payments in Europe require an extra confirmation — usually in a banking app or with an SMS code.
Fraud volumes did fall. At the same time a category of decline appeared that did not exist before: transactions where the card is valid and the money is there, but the authentication was never completed.
What it looks like in the data
These declines are often confused with ordinary “insufficient funds” cases, because in a shop’s admin panel both show up as a failed payment. The difference is in the response code.
If you see a rise specifically in authentication declines, the cause is usually one of three:
- The shopper never opened the banking app and the session expired.
- The banking app was opened, but the shopper never came back to the shop.
- The authentication window was blocked by the browser or got stuck on mobile.
The first two are shopper behaviour. The third is an integration problem, and it can be fixed.
What you can do
The simplest improvement is warning the shopper in advance. A sentence saying “you will be redirected to your banking app” before the button is pressed noticeably reduces abandoned sessions.
The second is the return flow. After confirming, the shopper should land back in the shop automatically rather than having to navigate back. If your integration relies on the shopper switching apps themselves, some payments will go missing.
The third is a retry path. If authentication failed, the shopper needs a clear “try again” button on the same page, not an error message that sends them back to the basket.
When exemptions are available
Not every transaction needs full authentication. Exemptions exist for low-value payments and for recurring payments on a stored card, and they can be requested.
They are not automatic — they have to be requested in the transaction itself, and the final say belongs to the card issuer. In practice that means exemptions are worth using but cannot be relied on as a guarantee.