When to Skip Strong Customer Authentication: A Practical Guide

The Conversion vs. Security Dilemma

Since the implementation of the Payment Services Directive 2 (PSD2), Strong Customer Authentication (SCA), often materialized by the 3D Secure (3DS) protocol, has become the standard for online payments in Europe. While this measure has significantly boosted security and reduced fraud, it has also introduced a major friction point in the purchasing journey. Studies show that up to 25% of transactions are abandoned at the 3DS step, due to forgotten passwords, issues receiving the SMS code, or simply user impatience.

For merchants, the equation is complex: how to comply with regulations and protect against fraud without sacrificing the user experience and, consequently, the conversion rate? The answer lies in the smart and strategic use of SCA exemptions. This practical guide will show you, step by step, how and when to bypass strong authentication in a secure and regulatory-compliant way, turning a constraint into a competitive advantage with Bridge Pay.

Prerequisites: What You Need Before You Start

Before diving into setting up exemptions, make sure you have the following:

• An active Bridge Pay merchant account: Our platform is natively designed to handle complex payment flows and optimize the application of exemptions. If you don't have an account yet, now is the perfect time to create one.
• Access to your Bridge Pay dashboard: You will need administrator or payment manager rights to access the risk and payment settings.
• A basic understanding of your risk profile: Do you know your current fraud rate? Your average basket sizes? This information will be crucial for defining relevant and secure exemption rules. Our Guardian dashboard provides you with detailed analytics on this point.

Detailed Steps to Implement SCA Exemptions

Step 1: Understand the Exemption Landscape

PSD2 is not a binary rule; it provides for several scenarios where SCA is not mandatory. Understanding them is crucial to building your strategy. The main exemptions are:

• Low-Value Transactions (LVT): For payments under €30.
• Transaction Risk Analysis (TRA): If your Payment Service Provider (PSP) and you maintain a very low fraud rate, you can request an exemption for transactions up to €500.
• Whitelisting: Customers can add a merchant to their "trusted list" with their bank, thus avoiding SCA for future purchases.
• Fixed-Amount Recurring Payments: Subscriptions. SCA is only required for the first payment.
• Merchant-Initiated Transactions (MIT): Transactions where the customer is not present (e.g., usage-based billing), after an initial authenticated agreement.

Bridge Pay allows you to juggle these exemptions through a dynamic rules engine. The goal is not to enable them all, but to create an intelligent policy that maximizes seamlessness for trusted customers while triggering SCA for suspicious transactions.

Step 2: Activate and Configure Bridge Pay's Dynamic Exemptions Engine

The first concrete step is to activate the brain of your strategy. In your Bridge Pay dashboard, navigate to the "Payments > Risk Settings" section. There you will find our Guardian Risk Engine tool.

The first option is a simple toggle: "Enable Dynamic Exemptions Engine". Once activated, Bridge Pay will analyze each incoming transaction and try to apply the most relevant exemption based on the rules you will define. It's a "request and see" approach: we present the exemption request to the cardholder's bank, which has the final say to accept or decline it (what's known as a "soft decline," which we automatically handle by re-presenting the transaction with 3DS).

[Screenshot description: The Bridge Pay dashboard, Guardian Risk Engine section. A toggle labeled "Enable Dynamic Exemptions Engine" is switched to the ON position. Just below, several subsections appear: "Low-Value Exemptions," "Transaction Risk Analysis (TRA)," etc.]

Step 3: Configure the Low-Value Transaction (LVT) Exemption

This is the simplest and most effective exemption for merchants with a low average basket size (e-books, streaming services, etc.).

In the "Low-Value Exemptions" subsection, enable the option. The rule is simple: any transaction below €30 can be exempted from SCA. However, PSD2 imposes limits to prevent abuse:

• SCA will be required if the customer has made 5 consecutive SCA-free transactions since their last authentication.
• SCA will be required if the sum of exempted payments exceeds €100.

You don't have to track these counters yourself. Bridge Pay and the customer's bank manage them automatically. Your only action is to authorize Bridge Pay to request this exemption for eligible transactions. For most merchants, it is advisable to activate it systematically.

Step 4: Deploy Transaction Risk Analysis (TRA) for Payments Up to €500

This is where the power of a PSP like Bridge Pay truly shines. TRA allows you to request an exemption for much higher transactions (up to €500), provided that your PSP's overall fraud rate in this segment is extremely low.

The acquirer's reference fraud rate must be below the following thresholds:

In your Bridge Pay dashboard, enable TRA. You will then have finer configuration options. You can set your own tolerance threshold. For example, you might decide to only request TRA for transactions between €30 and €150, even if our fraud rate would allow us to go higher. This is an excellent way to find a balance between conversion and security. Our Guardian engine enriches each transaction with dozens of data points (IP, device type, customer history, etc.) to decide in real-time if it's safe to request the exemption.

[Screenshot description: The TRA configuration interface in Bridge Pay. A slider allows adjusting the "Maximum amount threshold for TRA exemption request" from €30 to €500. Below, checkboxes allow adding custom rules, such as "Always force SCA for new customers."]

Step 5: Leverage Recurring and Merchant-Initiated Transactions (MIT)

For all subscription models, this exemption is fundamental. The principle is simple: SCA is applied during the initial payment (when setting up the mandate or subscription), but all subsequent payments are exempt if they are for a fixed amount and at a regular frequency.

Similarly, "merchant-initiated" transactions (MIT), where you bill a customer for variable consumption (e.g., a cloud platform that bills for usage), do not require SCA for each transaction. The key is to have a clear and authenticated initial agreement (a "Card-on-File" agreement).

With Bridge Pay, during the initial authentication, we link the transaction to a mandate. Subsequent transactions you initiate via our API using this mandate's identifier will be automatically marked as MIT and submitted without SCA friction, ensuring an uninterrupted revenue stream.

Code / Configuration: Requesting an Exemption via API

For technical integrators, you can control the exemption strategy directly at the API call level for each transaction. This gives you maximum flexibility. When creating a transaction, you can pass an sca_exemption object.

Here is an example of a JSON request body to create a €25 payment while explicitly requesting a low-value exemption:

{
  "amount": 2500,
  "currency": "EUR",
  "payment_method_id": "pm_123456789",
  "customer_id": "cus_987654321",
  "sca_policy": "REQUEST_EXEMPTION",
  "exemption_type_preference": [
    "low_value_transaction"
  ],
  "description": "Payment for order #Z2024-45"
}
    

In this example, sca_policy: "REQUEST_EXEMPTION" tells Bridge Pay to attempt to get an exemption. The exemption_type_preference field allows you to suggest an exemption type. If you don't specify it, our Guardian engine will choose the best option (LVT, then TRA, etc.). You can also force SCA with "sca_policy": "FORCE_SCA", even for a €10 payment, if you deem the transaction risky.

Verification: How to Check if It's Working?

Setup is one thing, verification is another. In your Bridge Pay dashboard, go to the "Transactions" section. Each transaction line displays a detailed status.

• Look for successful transactions that have the "SCA Exemption: LVT" or "SCA Exemption: TRA" badge. This is proof that the request was accepted by the issuing bank.
• Monitor your overall acceptance rate in the analytics dashboard. A successful exemption strategy should increase it by a few percentage points.
• Filter for failed transactions with the error code "Soft Decline / Authentication Required". If their number is low, it means our engine is correctly predicting when the bank will accept the exemption.

Troubleshooting: Common Problems and Solutions

Problem: "I've enabled exemptions, but many transactions under €30 are still subject to 3DS."

Solution: This is normal behavior. The customer's bank always has the final say. It can deny an exemption for several reasons: the 5 transactions / €100 limits have been reached, the customer is considered risky by their own bank, or the bank applies a very strict security policy. Bridge Pay handles this natively by re-presenting the transaction with 3DS. There is no lost sale, just additional friction. The goal is to reduce friction *most of the time*.

Problem: "My fraud rate has slightly increased since activating TRA."

Solution: It's time to adjust your rules. Go back to the Guardian Risk Engine settings and tighten your criteria. For example, lower the maximum amount threshold for TRA (from €150 to €80, for instance) or add a rule to always force SCA for transactions from high-risk countries. It's a constant process of iteration to find your optimal balance.

Problem: "A loyal customer is complaining about always having to authenticate."

Solution: This is the perfect opportunity to promote the "whitelisting" feature. Inform your customer that after a 3DS authentication, their bank will likely offer to add your site to their list of trusted merchants. Once that's done, they will no longer need to authenticate for future purchases from you, providing the most seamless experience possible.

Take Control of Your Payment Funnel

Strong authentication doesn't have to be a death sentence for your conversion rate. By proactively and intelligently using the exemptions provided by PSD2, you can offer a fast, frictionless shopping experience to the vast majority of your legitimate customers, while maintaining robust security for questionable cases. Tools like Bridge Pay's rules engine are essential for automating this complexity and turning it into a powerful lever for growth.

Ready to transform your payment experience and reclaim the sales lost to friction?

Create your Bridge Pay account today and start building a smarter payment strategy.