SCA and 3D Secure for card donations

SCA and 3D Secure

• Strong Customer Authentication (SCA) is a regulatory requirement for certain payments in the European Economic Area (EEA) and the United Kingdom. It requires at least 2 independent authentication factors, such as a password and confirmation on a registered device.
• 3D Secure (3DS) is a protocol used to authenticate online card payments and help meet SCA requirements. Authentication can happen without additional supporter input or require a verification step, such as entering a one-time code or approving the payment in a banking app.

Not every card donation requires a visible authentication step. Some payments qualify for exemptions, and others are outside the scope of SCA.

Card authentication during checkout

When a card payment requires additional verification:

1. The supporter submits their donation.
2. An authentication prompt appears during checkout.
3. The supporter follows their card issuer’s instructions.

After authentication, payment processing continues. The donation is confirmed if the payment succeeds. Successful authentication does not guarantee that the card issuer approves the payment.

The card issuer determines the verification method. Supporters may need access to their banking app, registered mobile device, or another authentication method provided by their bank.

Authentication for recurring donations

Supporters may need to authenticate their card when setting up a recurring donation.

Later installments do not necessarily require another authentication step. Payments made when the supporter is not actively checking out may qualify as merchant-initiated transactions. However, the card issuer can still require authentication for a later payment.

Security and limitations

3D Secure helps reduce unauthorized card payments, but it does not prevent all fraud or disputes.

• Eligible authenticated payments may receive liability protection for certain fraud disputes.
• Protection does not apply to every payment or every type of dispute.
• Authentication does not guarantee payment approval.
• SCA support does not replace your organization’s broader compliance responsibilities.

If authentication fails

If a supporter cannot complete verification:

• Ask them to follow the instructions in the authentication prompt.
• If the code or banking-app approval does not work, ask them to contact their card issuer.
• They can try another available payment method.

If required authentication does not appear or failures continue, contact Fundraise Up Support. Include the donation ID, if available, and the exact error message. Do not send card details or one-time verification codes.

For more information, see Strong Customer Authentication.