How can you ensure strong SCA authentication on your WooCommerce site?

Do you run a WooCommerce store or are you planning to launch one soon?

Then you can’t afford to overlook this. “This” is SCA strong customer authentication for your (future) WooCommerce site. 

Does this acronym mean nothing to you? Yet it is essential for reducing fraud and securing online purchases. 

Above all, it is vital that you comply with it, otherwise many payments may be declined and your sales may dwindle.

By the end of this article, you will have a complete overview of the SCA system, along with all our advice to make sure that your WooCommerce store complies with this regulatory measure.  

What is SCA?

A regulatory measure to reduce fraud

SCA stands for “Strong Customer Authentication.” It is a European regulatory system that makes it possible to verify the identity of anyone making an online purchase, using two identification factors.

This system aims to reduce fraud during online purchases, while strengthening the security level of online payment transactions. In France, it has been mandatory since May 15, 2021 for online purchases of at least 30 euros.

Overall, SCA is a measure provided for in European Directive (EU) 2015/2366 on payment services (PSD2).

This European regulation, adopted by the European Parliament in 2015 and entered into force in September 2019, repeals Directive 2007/64 of November 13, 2007 concerning electronic payment services in the internal market (PSD1).

Strengthen security and protect consumers

PSD2 pursues several objectives:

1. “harmonize payment regulations within the European Union”, says the France Num website;
2. modernize European payment services in the interest of consumers and businesses, by promoting “innovation, competition and efficiency” . This concerns, for example, opening the market to new players, called PSPs (Payment Service Providers), such as Stripe or PayPal.
3. strengthen the level of payment security and promote better consumer protection.

To this end, PSD2 provides for several components: 

• the requirement for strong authentication, therefore;
• the ban on surcharging: it is impossible to apply additional payment fees when paying by credit or debit card; 
• the strengthening of consumer rights and their data, with, for example, the reduction of the deductible remaining payable by the customer in the event of fraudulent card payment before cancellation from €150 to €50.

How does SCA strong authentication work?

One system, three elements

Before strong authentication came into force, security requirements were less strict when a customer wanted to initiate an electronic payment.

Most of the time, to complete an order, all the internet user had to do was enter a code sent by their bank by SMS on the merchant site. The verification took only one element into account.

SCA uses what is known as two-factor authentication. 

From now on, when a customer wants to make an online payment, they must provide two of the following three elements to validate the transaction: 

1. A knowledge element. This is something that only the user knows, for example a password or a numerical code. This cannot under any circumstances involve their bank card number or its expiration date.
2. A possession element. Here, identity verification is based on something that only the user possesses, such as their mobile phone or a token key.
3. An inherence element, meaning something that is specific to the person and defines them. This may include, for example, their voice, fingerprint, or facial recognition.

Strong authentication is implemented directly by banks and other electronic payment service providers. They are the ones directly responsible in the event of a problem.

However, as an e-commerce merchant, you must ensure that Strong Customer Authentication is properly supported on your WordPress e-commerce store (we will come back to this in detail), in order to comply with the regulations in force. 

How a payment funnel works with strong customer authentication

With a strong authentication system on WooCommerce, the customer goes through 4 steps during the payment funnel: 

1. They enter their payment information: cardholder name, credit card number, expiration date, and security code (Card Validation Code).
2. The payment institution (e.g., the user’s bank) sends them a notification in that bank’s smartphone app.
3. The customer enters a password or uses a biometric fingerprint to validate the payment during the checkout phase.
4. If the identification is confirmed, the process is validated and the payment accepted.

Who is affected by SCA on WooCommerce?

A broad scope of application

Strong authentication must be implemented for any electronic payment transaction, whether carried out in an online or offline environment.

Since PSD2 is a European directive, its scope applies to payment services provided within the European Union (and not worldwide).

As the provider Stripe explains, this applies to “card transactions where both the business and the cardholder’s bank are located in the European Economic Area (EEA)”.

This strong authentication measure affects the entire payments ecosystem:

• banks;
• payment providers (such as Worldline, Paybox, Ogone, Monext, Stripe, Paypal, etc.)  ;
• card networks (Visa, Mastercard);
• e-commerce merchants.

What exemptions are possible?

The legislator has provided for several cases of exemption from the customer strong authentication requirement. 

These exemption requests are made when the payment is processed. It is the cardholder’s bank that decides whether or not to maintain strong authentication, based in particular on the risk level of the transaction.

In practical terms, these exemptions apply, for example, to the following cases: 

• low-value transactions, where the sale amount does not exceed €30; 
• recurring transactions with the same amount and the same beneficiary; 
• low-risk transactions, meaning payments made to an e-commerce merchant with a low fraud rate; 
• telephone sales; 
• payments by corporate card;
• transfers between accounts held by the same natural or legal person. 

What is the impact of PSD2?

Strong customer authentication, and more broadly the PSD2 directive, introduce multiple benefits for both consumers and owners of e-commerce websites. 

Let’s go through them one by one.

Benefits for consumers

For consumers, PSD2 essentially means stronger protection. This concerns several aspects: 

• the security of their online purchases is improved, thanks to stricter standards. This reduces the risks of fraud and hacking; 
• their rights are more extensive. Consumers, for example, have the right to a no-questions-asked refund for euro direct debits;
• the confidentiality of their personal financial data is better protected at the source. For example, no data processing may take place without the consumer’s consent, in accordance with what is set out in the General Data Protection Regulation (GDPR).

In addition, consumers benefit from a new, smoother and more convenient payment experience.

Benefits for e-commerce websites 

For online store owners, SCA on WooCommerce offers clear advantages on several levels: 

• the risks of fraud are lower, since payer identification is strengthened. As a result, financial losses are more limited and management is easier, because potential disputes are reduced;
• consumer confidence increases because the payment verification procedure is more secure. A potential customer may then be more inclined to make a purchase, helping to increase your conversions;
• opening the market to competition allows you to test new service providers that are more likely to meet your needs and those of your customers; 

Did you know? Two-factor authentication does not only apply to online transactions. You can use this system to strengthen the security of your WordPress admin login page. Several WordPress security plugins (iThemes Security, SecuPress, Wordfence, etc.) allow you to enable two-factor authentication in just a few clicks. 

How can you ensure compliance with strong authentication on WooCommerce?

Now that you know how strong authentication works and its overall impact, it is time to find out whether your ecommerce store complies with the SCA system with WooCommerce. 

If this is not the case, many purchases will be declined on your WordPress website, and your revenue will be negatively impacted. So it is best to avoid that!

Technically, you need to make sure that your payment gateway allows online payments to be authenticated.

This is most often done via the 3D Secure 2 protocol, which guarantees compliance with the requirements of strong customer authentication in Europe.

Good news: the vast majority of payment providers use the 3D Secure 2 feature. 

To find out whether the one you are considering or the one you currently use on your WordPress website is compliant, contact your payment provider (or your bank), for example by asking its customer service or account management team.

To help you, WooCommerce has published a non-exhaustive list of several popular payment gateways that are compatible with Strong Customer Authentication for WooCommerce. The examples below offer integration: 

• Stripe; 
• Amazon Pay;
• Global Payments Gateway (formerly Realex);
• PayPal;
• PayPal powered by Braintree;
• Sage Pay;
• Sofort;
• Klarna Payments;
• Klarna Checkout, etc.

Another method available to you? The official WooCommerce extensions directory. In the “Payments” category, click on “Processors & gateways” to access a list of official plugins (select “France” from the list of countries):

After that, all you have to do is click on the one you are interested in to make sure it supports and offers integration with Strong Customer Authentication on WooCommerce (look through its description to find a mention of the term, for example).

If you are starting from scratch, we will finish by showing you how to benefit from SCA on WooCommerce using Stripe. 

How do you set up SCA on WooCommerce with Stripe?

Why use this platform?

Stripe is an online payment processing platform that allows you to accept payments in various forms, and therefore obviously by bank card. 

It brings together many advantages and features that make it a solution of choice for your WooCommerce site: 

• it uses strong customer authentication, which means you have nothing to do on your end; 
• it is very easy to use, both for the webmaster and the consumer (the latter can pay for items in one click with the Stripe Checkout option); 
• it offers a free WordPress plugin that connects with your WooCommerce store. This plugin can even integrate with contact form plugins such as Gravity Forms (via an add-on). In addition, Stripe works with any WordPress theme and any hosting provider; 
• it accepts both one-time and recurring payments from your customers (transaction fees are still charged on each payment received); 
• the payment process takes place directly on the merchant site. The buyer never leaves your site, which limits the risk of cart abandonment; 
• the platform also accepts SEPA direct debit, payment by bank transfer, as well as Apple Pay or Google Pay;
• the tool uses the 3D Secure 2 protocol;
• a dashboard gives you access to statistics on your store’s payments, orders, and transactions;
• purchases of products/services in more than 135 different currencies are possible;
• your customer does not need to have a Stripe account to pay for a purchase (unlike PayPal).

Now, we’re going to show you how to link this service to your WordPress store built with WooCommerce, using a short practical 4-step tutorial. As you’ll see, we’ll cover different topics in a practical way. 

Step 1: Create a Stripe account

First, you need to create an account to accept payments on your site/blog. 

To do this, go to the official Stripe website, then click the “Sign in” button at the top right: 

On the next page, click the link called “Sign up,” located below the login form:

Enter the following details: 

• your email; 
• your name;
• a password.

And click the “Create account” button:

You will then be asked to confirm your email address by sending you an email to your inbox.

You will then land on your dashboard. For now, your account is in Test mode. 

Activate your account to switch to live mode:

To do this, you mainly just need to add information about your business and add your bank account so you can receive payments.

Step 2: Update WooCommerce

When everything looks good on your dashboard, log in to your WordPress CMS admin interface. 

For the purposes of this test, we assume that you already have a hosting space, a configured WooCommerce store, and an active e-commerce theme.

If this is not the case, activate the e-commerce plugin and configure it using its setup wizard.

Before moving on, check that you are using the latest up-to-date version of the plugin. This is important so you can benefit from the latest improvements and features, and it helps strengthen your site’s security. 

To find out, go to the Dashboard > Updates menu. If you do not see the WooCommerce plugin appear in the section related to extensions in the WordPress updates menu, then everything is fine. 

Otherwise, update the e-commerce extension.

Good to know: Before carrying out a major update such as WooCommerce, remember to back up your WordPress website. To do this, you can use one of the many backup plugins such as UpdraftPlus, or a dedicated maintenance tool such as WP Umbrella, which offers a backup feature.

Step 3: Activate the WooCommerce Stripe Payment Gateway plugin

Once WooCommerce has been updated to its latest version, go to the Plugins > Add New menu.

In the search bar, type “WooCommerce Stripe Payment Gateway”. This is the official plugin created by WooCommerce:

Install and then activate this plugin. 

If your WordPress site or blog is not using HTTPS, the plugin will ask you to activate this protocol, which helps secure the connection to your WordPress site built with WooCommerce.

For an online store, this is an essential prerequisite for protecting and securing your customers’ payment (and personal) data.

To switch your site to HTTPS, you need  an SSL certificate. Most hosting providers (Kinsta, o2switch, OVH, etc.) allow you to activate one for free. 

Contact your hosting company to learn more, if applicable.

Step 4: Check the SCA configuration options in WooCommerce

Next, connect your Stripe account to WooCommerce by entering your LIVE API keys and “Webhooks” (a term familiar to developers).

You will find this information in the “Developers” section of your account:

Did you know? A webhook informs your application when an event takes place in your account. Stripe states that “webhooks are particularly useful for asynchronous events such as confirmation of a payment by the customer’s bank, a payment dispute by the customer, the successful completion of a recurring payment, or the collection of subscription payments.”

Then, in the “Payments” tab of the WooCommerce settings, simply make sure your Stripe account is enabled. And that’s it: Strong Customer Authentication on WooCommerce is ready to go.

If you wish, you can also run tests to simulate various transactions. To do this, check the “Enable TEST mode” box and then verify how it works on your theme:

Summary

SCA Strong Customer Authentication on WooCommerce is an essential measure to secure online transactions on the WordPress CMS, while reducing the risk of fraud. 

Throughout these lines, we have covered several topics. In particular, you have discovered the following elements: 

• how Strong Customer Authentication works;
• its scope of application;
• its impact on ecommerce site owners and managers and on consumers; 
• the means available to you to check your WooCommerce site’s compliance with Strong Customer Authentication; 
• how to integrate Stripe into your e-shop to benefit from strong authentication.

If you have a WooCommerce site, it is crucial to ensure that it complies with this regulatory requirement. Would you like support in deploying strong authentication on your online store?

Contact the Maintenance WP team. Available 7 days a week, our WordPress support service will provide you with a tailor-made solution that will meet your needs quickly, professionally, and effectively.