Why SCA compliance is an ML problem
Strong Customer Authentication (SCA) rules in the European Economic Area and the UK require two-factor authentication on electronic card transactions. But deciding whether to trigger that second factor isn't a binary call. Regulators allow a range of exemptions, and choosing among them involves weighing more than 20 distinct considerations tied to authentication and SCA eligibility. The right decision depends on a merchant's specific conversion goals, fraud tolerance, and transaction profile.
Stripe's authentication engine handles this decision-making by requesting applicable SCA exemptions on behalf of merchants to reduce customer friction while maintaining SCA compliance. The system is an ML model trained on fraud and conversion outcomes from hundreds of millions of historical card transactions. For each new transaction, it evaluates hundreds of variables, including authentication-specific outcomes like challenge success rates and the likelihood that a frictionless authorization will be granted, as well as charge-level fraud risk. The model matches the incoming transaction against that historical data and requests the authentication choices that best balance conversion, fraud risk, and cost.
This work brings ML to a part of payments that Stripe has long applied it to elsewhere, such as Radar for fraud blocking and Adaptive Acceptance for optimizing authorization pathways. Authentication decisions were a natural next frontier because of the sheer number of exemption options and the need to tune them continuously.
Measurable results since launch
Since the authentication engine became generally available five months ago as part of Stripe's authentication product, outcomes have improved across two key metrics. For SCA-eligible card transactions, the number of two-factor identification challenges shown to customers has dropped by 20%, while fraud has declined by 8% on average.
Those gains come from continuous model iteration. Stripe retrains and deploys a new version of the ML model every few weeks, adding features and adapting to the latest changes in network and issuer behavior. Since launch, the average authorization rate has improved by 61 basis points as a result of those ongoing refinements.
The practical effect is straightforward: more legitimate transactions move through without additional customer steps, and fewer fraudulent ones slip through the exemption process. For merchants, that translates directly into increased revenue and reduced operational overhead.
