SCA

Strong Customer Authentication: the PSD2 requirement that electronic payments and account access be confirmed with at least two independent factors.

The three categories are:

• Knowledge: something only the user knows, such as a password or PIN.
• Possession: something only the user has, such as a phone or card reader.
• Inherence: something the user is, such as a fingerprint or face.

Two factors must come from different categories, which is why a password plus a security question does not qualify. Certain low-value or recurring payments are exempt.