Strong Customer Authentication (SCA) and Subscription Renewals

Strong Customer Authentication — SCA — is the European requirement that a customer confirm certain online payments, usually by approving them in their banking app. If you sell to customers in Europe or the UK, it affects your subscriptions wherever your store is based.

The good news is that it mostly affects one payment: the first one.

Why the first payment is authenticated

When a European customer subscribes, the first payment is typically authenticated — the customer confirms it with their bank. That authentication does two jobs: it pays for the first order, and it establishes the agreement under which future renewals will be charged.

On Shopify, the checkout handles this. That is one of the better reasons to keep subscriptions on Shopify’s own checkout rather than a custom flow: authentication at signup is what makes later renewals possible.

Why renewals usually aren’t

A renewal is a merchant-initiated transaction. The customer isn’t present; you are charging them under the agreement they authenticated earlier. Charges like that generally fall outside SCA — the customer is not asked to authenticate every month, which would make subscriptions unworkable.

Why some come back anyway

“Generally” is doing real work in that sentence. A customer’s bank can decide a particular renewal needs the customer to confirm it. When that happens, the charge is not declined for lack of money — it is sent back asking for authentication, and only the customer can complete it.

Some situations make this more likely:

• The amount has changed from what was originally agreed — a price rise, an added product.
• The bank’s own risk checks flag the charge.
• The original agreement wasn’t set up cleanly at the first payment.

What this means for your retries

An authentication request is not an insufficient-funds decline, and treating it like one wastes your entire retry sequence. Retrying a charge the bank wants the customer to confirm will keep failing, however many times you try, until the customer acts.

So a failed renewal needs to be sorted by what actually went wrong:

• Insufficient funds → retry, timed around paydays
• Authentication requested → get a link to the customer so they can confirm it
• Expired or invalid card → ask for a new payment method

How to design a retry schedule.

Super Subscription records renewals that come back asking for authentication as their own outcome, separate from ordinary declines, so they don’t disappear into a single failed-payments number.

How to reduce authentication requests

Keep the renewal amount predictable. A charge that matches the original agreement is the least likely to be sent back. If you change the price, tell subscribers first — a surprising charge is more likely to be questioned by both the bank and the customer. Raising prices.

Use a descriptor customers recognise. A charge from a company name they don’t know is more likely to be flagged and more likely to be disputed.

Remind before renewing. A customer who knows a charge is coming is ready to approve it if asked. Pre-renewal reminders.

Check your own numbers

If you sell into Europe, look at how many of your failed renewals are authentication requests rather than declines. If it’s a meaningful share, the fix is a clear authentication link in your recovery emails — not more retries.