SCA & 3-D Secure

Strong Customer Authentication (SCA) is required for many European card payments. digid pay surfaces it cleanly: when a card needs authentication, the PaymentIntent moves to requires_action and a 3-D Secure challenge runs inside the checkout flow — no page navigation, no new tab.

Status. The handling contract below is contract (built with the facade). The acquirer performs SCA per scheme rules; digid pay never weakens or bypasses it.

When challenges occur

A challenge is triggered by the card scheme/issuer — typically:

• new merchants or high-risk categories (fraud rules),
• high-value or unusual transactions,
• issuer policy for certain cards/banks.

You cannot predict it from the card number; you handle it whenever the API says requires_action.

The no-leave-page model

With the checkout snippet or Secure Fields, the challenge renders in an overlay inside the fields' frame. Your customer authenticates with their bank (3-D Secure) without leaving your page. The snippet resumes automatically.

Handling requires_action (API path)

1. Confirm the PaymentIntent.
2. Response status is requires_action with a next_action.
3. Present the challenge via Secure Fields / the snippet using the same client_secret.
4. On completion, retrieve the intent or await the webhook — the state is succeeded or failed.

curl https://api.digid.cc/v1/payment_intents/pi_1Ab... -u sk_live_...:

{
  "id": "pi_1Ab...",
  "status": "requires_action",
  "next_action": { "type": "challenge", "redirect_to_url": null }
}

With the snippet, you don't handle the challenge yourself — the snippet does:

case 'payment_intent.requires_action':
  // snippet is presenting the 3-D Secure challenge in-frame
  break

Liability shift

When authentication succeeds, the liability for fraudulent chargebacks shifts to the card issuer. That is why SCA is not just compliance — it protects you. digid pay does not decide the shift; the acquirer applies scheme rules and the result is visible on the transaction record.

Test in sandbox

Use the SCA test card in Sandbox to exercise requires_action end to end:

• confirm → requires_action → complete the challenge → succeeded.

Related

• Payments — statuses and confirm.
• Secure Fields — styling the challenge surface.
• Disputes — liability and chargebacks.