The Card Payment Authentication Gap: Why SCA Solved the Door and Left the Session Open

Strong Customer Authentication changed the economics of payment fraud.

By requiring two or more independent authentication elements in many electronic payment journeys, SCA made stolen credentials alone less useful. In card-not-present commerce, EMV 3-D Secure added richer transaction and device data, enabling issuers to assess risk and, when needed, challenge the customer.

That matters, and the evidence shows it. The European Central Bank and European Banking Authority continue to describe SCA as effective against the types of fraud it was designed to address, particularly card-payment fraud.

But SCA answers a specific question at a specific moment:

Should this login, account action or payment be authenticated?

It does not necessarily answer a different question that can become decisive seconds or minutes later:

Is the authorised customer still the person controlling the session?

SCA protects the door. The emerging gap is what happens once the door has opened.

Authentication is a moment. Fraud can be a journey.

A successful authentication creates a period of trust.

The customer may remain signed in, move between screens, change account details, add a card to a wallet, approve a purchase or contact customer support. For usability, many of those steps rely on the trust established earlier in the journey.

Fraudsters look for ways to exploit that continuity.

The attack does not always need to defeat authentication head-on. It may instead take control after authentication, operate through a shared or unattended device, or manipulate the genuine customer into completing an apparently legitimate challenge.

The latest joint ECB and EBA fraud reporting illustrates the broader shift. Total payment fraud in the European Economic Area rose from €3.5 billion in 2023 to €4.2 billion in 2024.

The authorities found that SCA-authenticated transactions were generally less susceptible to fraud, while also highlighting fraud targeting exempt transactions or manipulating legitimate customers into authorising fraudulent ones. For EU and EEA-issued cards, reported fraud losses reached €1.329 billion in 2024, up 29% year on year.

The lesson is not that SCA has failed.

It is that controls built around a single authentication event cannot, by themselves, resolve every risk that develops across the rest of a digital session.

Four ways trust can break after entry

1. A legitimate session changes hands

The genuine customer authenticates successfully, but another person then gains access to the unlocked device or active session.

The initial authentication remains valid even though control of the session has changed.

2. A device is shared

Shared household and workplace devices can blur the relationship between the account holder, the device, and the person currently using it.

Device recognition may show that the hardware is familiar without proving that the person using it is authorised.

3. A session is hijacked

Malware, stolen session tokens or remote-access tools can allow an attacker to operate within an authenticated environment.

Rechecking a password may add friction without addressing who is physically—or remotely—in control.

4. The customer is coached through the controls

Social engineering can turn a genuine customer into an unwitting participant.

A fraudster may persuade someone to disclose a code, approve a card authentication challenge, or follow instructions while the attacker shapes the transaction.

The biometric or possession factor may be genuine, but the intent and context are not.

The missing layer: identity assurance during the session

Card issuers and payment platforms already use layered controls, including:

• Device intelligence

• Behavioural analytics

• Transaction monitoring

• EMV 3-D Secure

• Velocity rules

• Step-up authentication

Continuous facial recognition can complement those controls by adding a signal about human presence and identity continuity.

Instead of treating identity as permanently settled by a single successful check, continuous identity assurance can help determine whether the authorised person remains present as risk increases.

It can operate continuously or around selected high-risk actions, depending on the organisation’s risk model, customer journey and privacy requirements.

The aim is not to place every customer under constant challenge.

It is to make trust more adaptive: low friction when identity signals remain consistent and a proportionate intervention when they do not.

Where continuous assurance can add value

The strongest use cases sit at the intersection of identity change, transaction risk and recoverability. These can include:

• Adding a payment card to a digital wallet or new device

• Changing contact details, credentials or recovery settings before a payment

• Using stored card credentials from an unfamiliar device or environment

• Approving an unusually high-value or atypical card transaction

• Moving from authenticated support into a refund, payout or account-change workflow

• Maintaining assurance throughout a long or sensitive merchant, issuer or banking session

In each case, continuous facial recognition is not the decision engine on its own.

It is an additional signal that can support an appropriate response. Depending on the organisation’s policies, that could mean allowing the journey to continue, requesting another check, limiting a sensitive function or escalating the activity for review.

Security must remain proportionate

Biometric technology earns trust only when it is deployed with a clear purpose and careful governance.

Any implementation should be designed around:

• Data minimisation

• Security

• Accessibility

• Transparency

• Proportionality

• Meaningful alternatives for customers who cannot or do not wish to use facial recognition

Organisations should define precisely when the signal is active, what it is used for, how long any data is retained, how false matches or non-matches are handled and how customers can challenge a decision.

The control should be tested not only for its potential to reduce fraud, but also for bias, usability and proportionality across different customer groups.

When done well, continuous assurance is less about adding another barrier and more about reducing reliance on repeated passwords, codes, and blunt interruptions.

The experience can become both safer and more natural because identity assurance is maintained in the background and friction is reserved for genuine uncertainty.

From Strong Customer Authentication to continuous customer assurance

SCA remains a foundational control.

EMV 3-D Secure remains vital to card-not-present authentication. Transaction monitoring and device intelligence remain essential.

But the threat model is moving beyond the front door.

For card issuers, banks and payment platforms, the strategic question is no longer only whether a customer authenticated correctly.

It is whether trust should persist when the person, device, behaviour or transaction context changes during the journey.

The next generation of payment security will not replace SCA. It will extend its underlying principle—strong evidence of identity—from the moment at the door to the higher-risk moments that follow.

How YEO can help

YEO’s patented Continuous Facial Recognition SDK is designed to add ongoing identity assurance to digital customer journeys.

For payment providers, it offers a privacy-conscious, on-device way to assess whether the authorised customer remains present during higher-risk parts of a session, alongside existing SCA, fraud detection, and transaction monitoring controls.

If you are reviewing how identity risk changes after authentication, talk to YEO about where continuous identity assurance could fit within your payment journey.

Book a Session Identity Gap Assessment