SCA requires the merchant verify the customer through at least how many methods?

• A. Two
• B. One
• C. Three
• D. Four

Answer: (A)

Strong Customer Authentication requires the merchant to verify the customer using at least two independent authentication methods. There are three categories: something you know (like a password or PIN), something you have (a phone, hardware token, or card), and something you are (biometric data such as a fingerprint). Requiring two different categories strengthens security because compromising one factor doesn’t guarantee access to the payment. So typical verifications combine two factors, for example a password plus a one-time code from an authenticator, or a biometric check plus a one-time code. There are exemptions in some low-risk or specific scenarios, but the standard expectation is two distinct verification methods.