Strong Customer Authentication is a requirement under the Payment Services Regulations 2017, implementing PSD2 in the UK, that requires multi-factor verification for most online card transactions. It was phased in for UK ecommerce from 2021. SCA requires authentication using at least two of three factors: something the customer knows, has, or is. Exemptions exist for low-value transactions, trusted beneficiaries, and transactions assessed as low risk by the issuing bank. UK Finance and the FCA publish data on SCA implementation and fraud rates.