# Strong Customer Authentication

Source: https://docs.gocardless.com/docs/send-money/strong-customer-authentication

# Strong Customer Authentication (SCA)

**Strong Customer Authentication (SCA)** is a regulatory requirement under the Payment Services Regulations 2017 in the UK and PSD2 in the EEA. It is designed to verify your identity in order to provide protection against fraud.

The regulation requires SCA when you make a payment or access your account. You will need to verify your identity using at least two of the following three factors:

- _Something you know_ (e.g. a password, PIN, or security question)
- _Something you possess_ (e.g. a mobile phone, hardware token, or a smart card)
- _Something you are_ (e.g. fingerprint, facial recognition, or other biometric data)

## When you make a payment through our dashboard

If you make a payment from the dashboard, you will receive an SMS with an authentication code that is **dynamically linked** to the details of the payment amount and payee, making it difficult for the code to be manipulated or used for another payment.

1. You first log in with your password (_something you know_).

![Image -> Sign In](https://images.ctfassets.net/b2dmfxhmyqno/6vnV5WSDmzOjHpIEj9LpMs/5abe2139658a854adf82c50d66de014c/Screenshot_2025-10-02_at_15.28.22.png)

2. You will be able to create the payment by inputting the amount and recipient.

![Image: Outbound Payments -> Initiate](https://images.ctfassets.net/b2dmfxhmyqno/75Y6hfyWbK1CMPrvNL87Nr/cd97ca5f2345cc1139d9526f39859480/Screenshot_2025-10-07_at_16.27.27.png)

3. After reviewing your payment details, you'll be asked to enter a code sent to your phone (_something you have_).

![Image: Outbound Payments -> SCA dialog](https://images.ctfassets.net/b2dmfxhmyqno/7LytlqERIySElYwMAXnkxX/6388507e4d31c2cca57de71ffef0e64c/Screenshot_2025-10-02_at_15.30.18.png)

### Important points to keep in mind

1. **Make sure SMS 2FA is enabled.** You need to have SMS-based 2FA turned on for your account. If it's not, your payment won't go through because we can't send you the code.

   ![Image: User Settings -> 2-factor authentication](https://images.ctfassets.net/b2dmfxhmyqno/4qsU7PgERREGcjF60eb2cw/5c1d4f1b98fd722f373864cda2b20899/Screenshot_2025-10-02_at_15.41.57.png)

2. **Approve within 5 minutes.** After you initiate a payment, you have 5 minutes to enter the authentication code. If you do not provide a valid code in time, the payment will be cancelled. You have 5 attempts to authenticate. After 5 failed attempts, your account will be blocked from making outbound payments or withdrawals for 15 minutes.

3. **Resend the authentication code.** You can request to resend the authentication code up to two times. If you still don't approve the payment after the retries, it will be cancelled after 5 minutes.

## Exemptions to SCA

The regulations provide a few exemptions from SCA for outbound payments. At GoCardless, we support the **Trusted Beneficiary** exemption. When you make a payment to a recipient and SCA is applied, they are added to a trusted list so that subsequent payments can proceed without requiring authentication.

GoCardless automatically maintains a list of trusted beneficiaries — you cannot manage or edit this list. A recipient is automatically marked as trusted after the first successful payment sent to them that includes a completed SCA and passes the Confirmation of Payee check with `full_match` results.

> **Info:**
> Once trusted, a recipient remains on the list unless no payment is made to them for 13 months. If
>   the 13-month period lapses, they are removed and SCA will be triggered on the next payment.

## What do you need to do if you don't use the GoCardless Dashboard?

If you're building your own API integration, you must include your organisation's authorisation token in every request (_something you know_). You should also sign your API requests with your organisation's certificate (_something you own_) to verify their authenticity. This helps ensure security and compliance with PSD2 regulations.

## What's next?

  
#### [Bank Account Holder Verification](/docs/send-money/bank-account-holder-verification)

Understand how Confirmation of Payee checks work and how to interpret the results.

  
#### [API Request Signing](/docs/send-money/api-request-signing)

Set up request signing to meet the API authentication requirements.