Strong customer authentication and 3-D Secure: how does it work for your bookings?

Strong customer authentication (SCA) is a European requirement stemming from the Payment Services Directive, known as PSD2: for most online payments, the payer's bank must verify their identity using at least two independent elements. For cards, it goes through the 3-D Secure protocol, often an approval in the banking app. With GDA Kraft Booking, this step is handled by Stripe's payment page at booking time, and by a link sent to the guest if their bank requires it when the balance is charged.

What do the rules say?

• Directive (EU) 2015/2366 (PSD2) sets out the principle of strong authentication: text on EUR-Lex.
• Delegated Regulation (EU) 2018/389 lays down the technical standards and exemptions; most of it has applied since 14 September 2019: text on EUR-Lex.

Sources consulted on 12 October 2026. In France, the roll-out to online card payments was organised gradually under the aegis of the Banque de France's Observatory for the Security of Payment Means (this point concerns France only).

What are the two elements required?

Strong authentication combines at least two elements from three categories:

So the card number and security code alone are generally no longer enough. According to Stripe's guide to strong customer authentication (consulted on 12 October 2026), Apple Pay and Google Pay already include user authentication on the device.

How does authentication work at booking time?

1. The guest or client chooses their dates or slot, then is sent to the payment page hosted by Stripe.
2. They enter their card or choose Apple Pay or Google Pay.
3. If their bank requires it, a 3-D Secure window opens: they approve in their banking app or enter a code.
4. Once the payment is accepted, they return to your site and the booking is confirmed.

There is nothing for you to configure: 3-D Secure is built into the flow as soon as your payments are active (see Enable Stripe payments). It is the payer's bank that decides whether or not to request authentication, including when an exemption would be possible.

What about the balance charged before arrival?

An off-session payment is a charge made without the payer being present on the site, such as the automatic balance charge in GDA Kraft Booking, the plugin by Global Digital Agency.

• When paying the deposit, the guest explicitly agrees that their card, saved by Stripe, will be charged the balance on the scheduled date. This first transaction is authenticated.
• Merchant-initiated payments on this basis are in principle processed without further authentication. But the guest's bank can still require it.
• In that case, the guest receives the email "Your booking balance is due": its "Pay the balance" button opens a secure Stripe payment page where they approve the transaction. The guest area does not currently allow the balance to be paid.

The full charging process and its three possible outcomes are described in Deposit, balance and tourist tax. You receive an email alert ("Balance charge failed") and track pending cases in Kraft Console › "Bookings", "Payments to follow up" tab.

What should you advise your guests?

• Have their phone and banking app to hand when paying.
• Check that the contact details registered with their bank (phone number) are up to date.
• Keep an eye on their emails around the balance charge date, including the spam folder.
• If it fails repeatedly, contact their bank: see Payment declined: what should I do?.

Frequently asked questions

Can I turn off 3-D Secure to simplify payment?

No. Strong authentication is a regulatory requirement and the decision to request it lies with the payer's bank. Stripe's flow includes it automatically.

Does the guest have to authenticate again for the balance?

Generally not, because they agreed to this charge when paying the deposit. If their bank asks for it anyway, they receive an email with a "Pay the balance" button to approve the payment on the Stripe page.

Does strong authentication apply to cards issued outside Europe?

The requirement mainly covers payments where both the merchant and the payer's bank are located in the European Economic Area. A card issued elsewhere may nevertheless be subject to 3-D Secure if its bank provides for it.

What happens if the guest does not complete authentication for the balance?

The balance remains due: the booking appears in the "Payments to follow up" tab of Kraft Console, and the automatic charge is not retried. If they pay you another way, record the payment with "Record a payment received offline" (Kraft Console) or "Add an offline payment" ("05 Payments" tab of the booking file).