Contactless limits and Strong Customer Authentication, explained

Two separate rules govern when a card payment needs extra verification: a contactless spending limit for in-person taps, and Strong Customer Authentication (SCA) for online and remote payments. Both exist for the same reason — reducing fraud on payments where nobody's checking a signature or asking for ID — but they work differently.

Contactless limits, in person

UK contactless payments currently carry a single-transaction limit of £100. Beyond the amount, card networks and issuing banks also apply a running total: after a certain number of consecutive contactless taps, or a cumulative spend threshold, the card will prompt for chip-and-PIN on the next transaction, even if it's under the limit. This is a security check by the card network, not something your card machine controls.

• If a customer's contactless is declined and they're asked for PIN, that's normal — it isn't a fault with your terminal
• Apple Pay, Google Pay and other digital wallets follow the same contactless limit as a physical card
• Business and corporate cards can carry different limits, set by the issuing bank rather than the retailer

Strong Customer Authentication, online

SCA is a regulatory requirement under UK and EU payment services rules, requiring two of three types of verification for many online and remote card payments:

• Something the customer knows — a password or PIN
• Something the customer has — their phone, to approve via a banking app or one-time code
• Something the customer is — a fingerprint or face scan

In practice, this is what shows up at checkout as a 3D Secure prompt — the customer is redirected to (or shown a pop-up from) their bank to confirm the payment, often via their banking app.

What's exempt from SCA

• Low-value payments — small transactions below a set threshold can sometimes skip authentication, at the issuing bank's discretion
• Recurring subscriptions — the first payment typically needs SCA, but subsequent identical recurring charges are usually exempt
• Trusted merchant lists — customers can whitelist a merchant with their bank to skip repeated authentication
• MOTO transactions — payments taken over the phone or by post generally fall outside SCA, since the cardholder isn't present at a screen to authenticate

What this means for your checkout

If you're using a modern payment gateway (Stripe, Braintree, most others), 3D Secure and SCA handling is built into the checkout flow automatically — there's rarely anything extra to configure, beyond making sure your integration is using an up-to-date version of the gateway's checkout, rather than an old card-only form. If your website has an older or custom checkout, it's worth confirming with your gateway provider that SCA is properly supported, since transactions that fail authentication will simply be declined.