When a customer makes an online payment, their bank may "challenge" them to provide more information before authenticating the payment – this is where SCA comes in. SCA requires you to build additional authentication into your payment flow, using two out of the following three authentication elements: Something the customers knows (like a password or PIN) Something the customer has (like a mobile phone or wearable device) Something the customer is (like their fingerprint or facial recognition)