Strong Customer Authentication (SCA)
The PSD2 requirement that electronic payment authentication use at least two of: knowledge, possession, inherence. Plus dynamic linking, the auth factor must be tied to the specific transaction amount and payee.
Dynamic linking is what separates SCA from ordinary MFA: the authentication has to be cryptographically tied to the amount and the payee, and the user has to see them. That rules out an approval prompt that just says "confirm sign-in". Exemptions for low-value and recurring payments exist and are where most of the implementation complexity actually sits.
See also: PSD2, MFA, step-up auth, FAPI
Related on Start with Identity
- GlossaryCJIS Security Policy
The CJIS Security Policy is the FBI's set of minimum security requirements for anyone who accesses, processes, stores or transmits criminal justice information
- GlossaryRisk-Based Authentication
Risk-based authentication (RBA) adjusts authentication requirements based on signals such as device, location, network, and behavior. Low-risk sessions pass smo
- GlossaryAuthenticator Assurance Level (AAL)
NIST 800-63B levels describing authentication strength. AAL1: single factor. AAL2: multi-factor. AAL3: multi-factor with phishing-resistant cryptographic authen
- GuideCustomer Identity Verification Guide: KYC, Document Verification, and Fraud Prevention
Implement customer identity verification with KYC processes, document verification, liveness detection, progressive profiling, and fraud prevention strategies.
- BlogEntra ID stops delivering SMS and voice codes on February 1, and global admins go last
From February 1, 2027, Microsoft stops providing SMS and voice authentication in Entra ID, and users with no other method must register a passkey to keep signin
- CVEOkta Verify for Windows local privilege escalation
Okta Verify on Windows could be turned into a local privilege escalation. The MFA app on the endpoint is part of the identity plane. Pair with Okta's 2024 FastP