Skip to content

Eight weeks until mandatory SCA for online credit card payments

Published on:

By 31 December 2020, in eight weeks’ time, online shops must fully support strong customer authentication (SCA) for online card payments. In the coming weeks, card issuers will increasingly reject online card payments without SCA, for progressively lower amounts.

Three hexagon icons for strong customer authentication: fingerprint with tap gesture, smartphone with euro and check mark, and password field with asterisks.

With 3-D Secure (3DS) from EMVCo for SCA on card payments, cardholders can be verified quickly and securely, for example with a simple fingerprint or mobile PIN. Without support for 3DS, an online shop will no longer be able to let customers pay online by credit card from 1 January 2021.

Online credit card payment displayed on a laptop

Card issuers are finding that most incoming card payments are still submitted without authentication. When they subsequently request authentication with a so-called soft decline, fewer than one in twenty transactions can still be completed successfully. If you are an online retailer or payment institution and do not yet support 3DS, contact your payment service provider or acquirer urgently.

Allow enough time for thorough testing

Online shops that introduce 3DS authentication for online card payments well before the end of the year can test it extensively and without pressure, while immediately benefiting from higher conversion and a lower fraud risk. The latest version, which all Dutch credit card issuers support as of October and which offers the best customer experience, is 3DS v2.1 or later. 3DS v1.0 also remains available.

Where does the Netherlands stand?

By 1 January 2021, every link in the online card payment chain in the Netherlands must fully comply with the EU guidelines for SCA. The European Banking Authority (EBA) previously postponed the deadline for introducing SCA by 15 months, and it will not be postponed again.

All Dutch credit card issuers, transaction processors and payment institutions are currently fully on schedule to meet the deadline. Using soft declines, online credit card payments without 3DS, known as legacy transactions, will be conditionally rejected with increasing frequency in the run-up to 1 January.

Shortly before the 1 January 2021 deadline, and even closer to the busy Black Friday period and the holidays, most online card payments were still being submitted to Dutch card issuers by online shops without authentication. From the deadline, online shops without 3DS will no longer be able to accept credit cards at all.

Online shops may be exempt from authentication for certain online credit card transactions. Retailers can ask their own payment service provider or acquirer how to make use of these exemptions.

Related articles