PSD2 Strong Customer Authentication (SCA) is an EU payment security requirement that adds extra verification to many electronic transactions. It usually means at least two different factors are checked, such as something the customer knows, has, or is. The goal is to reduce card fraud when a payment is initiated online, in-app, or through other remote channels covered by the rule.
In cyber security, PSD2 SCA matters because it changes how attackers target payments. Credential theft alone is often not enough if the transaction needs a second factor or a risk-based step-up challenge. Defenders use SCA to make unauthorized card use harder and to lower chargeback and account takeover risk. In practice, SCA is enforced by payment gateways, banks, and authentication flows such as one-time passcodes, banking app approvals, or biometric checks. It strengthens the transaction layer, but it does not secure the terminal, device, or merchant network by itself.