PSD2 Strong Customer Authentication Engine

Merchant Risk Profile

Reference fraud rate 0.05%

Avg. transaction value €120

Transaction throughput 3.0/s

RTS Exemptions

Trusted-beneficiary whitelist

Low-value exemption (<€30)

Gate Readouts

Current TRA threshold

€100

SCA challenge rate

Frictionless rate

Transactions processed

TRA exemption (frictionless)0 Whitelisted payee0 Low-value exemption0 SCA / 3-D Secure challenge0

How it works

Under PSD2's Regulatory Technical Standards (RTS, Article 18), an acquirer may skip Strong Customer Authentication for a card-not-present payment using Transaction Risk Analysis (TRA) if the payment amount is at or below a threshold set by the payment provider's own rolling fraud rate:

fraud rate ≤ 0.01%  →  TRA threshold = €500
fraud rate ≤ 0.06%  →  TRA threshold = €250
fraud rate ≤ 0.13%  →  TRA threshold = €100
fraud rate  > 0.13%  →  no TRA exemption (SCA required)

Two further exemptions apply independently of TRA: a trusted-beneficiary whitelist (Art. 13 — the payer pre-approved this payee) and a low-value exemption (Art. 16 — single payments under €30). This simulator evaluates every transaction against that decision table live at a "gate": particles below the current threshold, on the whitelist, or under the low-value cutoff sail through frictionless (blue/purple/amber); everything else is routed to the red lane and passed through the spinning ring — a stand-in for the 3-D Secure / SCA challenge (device biometric, OTP or app approval) required by Article 97 of PSD2 itself. Raising the reference fraud rate narrows the TRA band and pushes more traffic into SCA — the real trade-off issuers manage between fraud loss and checkout friction.

Note: real low-value/TRA exemptions also track cumulative counts and amounts per payer over time (Art. 16, Art. 18(2)); this simulator applies the per-transaction threshold only, to keep the mechanism legible.

Risk-Based Authentication GateFrictionless lanes ↑ · SCA challenge lane ↓

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.