Two of three, and independent
Why can a €40 online order set off a check in your banking app while a €40 coffee paid by tapping goes straight through? Blame, or thank, the EU’s 2015 payment services directive, PSD2.
Its Article 4(30) asks for two or more elements out of three categories, knowledge, possession and inherence. They have to be independent. A thief who learns your PIN should learn nothing about your phone from it.
Article 97 lists the moments. Logging in to a payment account online is one, starting an electronic payment another, and so is any remote action that could open the door to fraud. For a payment made at a distance, the code must also be tied to the exact amount and the exact payee, which the law calls dynamic linking.
The detail sits in Delegated Regulation 2018/389. Its Article 4 caps failed attempts at five in a row before a block, and online banking must log you out after five idle minutes. Britain’s Payment Services Regulations 2017 carry an almost identical definition in regulation 2.
What counts as a factor
Some familiar details do not qualify. In an opinion of June 21, 2019, the European Banking Authority ruled out the long number and security code printed on a card as knowledge. A username fails as well. So does an email address. A password, a PIN, a passphrase or a memorized swiping pattern passes.
Phones are where possession usually comes in. A device proven by a one-time code works, as does an app locked to one handset or a signature from a private key, while a browser with no tie to a device, or a printed sheet of codes, does not. Fingerprints, faces, voices and irises, even the way you type, can serve as inherence.
Text messages are the odd case. When your bank texts you a code, the thing you possess, in the EBA’s reading, is typically the SIM card tied to your number rather than the message. Nor does that code count as a knowledge element, the EBA adds, because knowledge has to exist before the payment starts.
When the check is skipped
Exemptions explain the coffee. Article 11 of the EU standards lets a provider skip SCA for a contactless payment of up to €50, as long as the running total since the last check stays within €150, or the count within five payments. Article 16 does the same online for amounts up to €30, with a €100 or five-payment ceiling, and Article 18 allows a skip when real-time risk analysis rates a remote payment as low-risk.
Britain has moved away from fixed caps. According to the FCA’s Handbook Notice 136, changes in force from March 19, 2026 remove the regulatory contactless limits, previously £100 a payment and £300 or five payments in a row, and let providers set their own under a risk-based exemption. The FCA expects most to keep their existing limits in the short term.
3D Secure and the liability shift
At an online checkout the check usually runs through 3D Secure. Payments company Stripe’s SCA guide says card payments require 3D Secure to meet the rule, that banks may decline payments that skip it, and that exemptions are not guaranteed.
The money angle is the liability shift. When a payment authenticated through 3D Secure is disputed as fraud, Stripe says liability typically moves from the merchant to the card issuer, but when the issuer grants an exemption, that shift does not apply. A merchant weighing chargeback risk should check which of its payments were actually authenticated.