SCA is why your European checkout drops customers

def create_3ds_payment(amount, card_details, customer_info):
    """
    Create payment with 3D Secure authentication.

    3DS 2.0 is much smarter than the old version - it uses machine learning
    to decide which transactions actually need extra authentication. Many
    transactions go through without any customer friction.

    The key is providing rich context data so the bank can make an
    intelligent risk assessment.
    """
    payment_intent = {
        'amount': amount,
        'currency': 'EUR',  # SCA applies under PSD2; sub-€30 transactions may qualify for the low-value exemption
        'payment_method_data': {
            'type': 'card',
            'card': card_details
        },

        # This metadata is crucial for 3DS 2.0 risk assessment
        # The more context you provide, the less likely customers
        # will be challenged for authentication
        'metadata': {
            'customer_email': customer_info['email'],           # Helps identify returning customers
            'customer_phone': customer_info['phone'],           # Additional identity verification
            'shipping_address': customer_info['address'],       # Flags if different from billing
            'billing_address': customer_info['billing_address'], # Primary verification point
            'customer_age_days': customer_info.get('account_age_days'),  # Established customers = lower risk
            'previous_purchases': customer_info.get('purchase_count', 0), # Purchase history helps
            'delivery_timeframe': 'same_day',                   # Delivery speed affects risk score
            'purchase_category': 'digital_goods'                # Product type influences risk
        },

        # Request 3DS explicitly for EU compliance
        'payment_method_options':
        }
    }

    return payment_processor.create_payment(payment_intent)

def handle_3ds_authentication(payment_intent):
    """
    Handle the 3D Secure authentication flow.

    This is where customers might get redirected to their bank's website
    to prove they own the card. The flow varies by bank - some use SMS,
    others use apps, some use biometrics.

    Your job is to handle the redirect gracefully and process the result.
    """
    if payment_intent.status == 'requires_action':
        # Customer needs to complete 3DS authentication
        # This happens when the bank decides extra verification is needed

        # Get the authentication URL from the payment processor
        auth_url = payment_intent.next_action.redirect_to_url.url
        return_url = payment_intent.next_action.redirect_to_url.return_url

        return
    elif payment_intent.status == 'succeeded':
        # Payment went through without challenge, or customer successfully authenticated
        # You now have liability shift protection from the card network
        return
    elif payment_intent.status == 'requires_payment_method':
        # 3DS authentication failed - customer couldn't prove card ownership
        # This is different from a regular decline - the card might be valid
        # but the customer failed authentication
        return
    else:
        # Other failure reasons - expired card, insufficient funds, etc.
        return

from dataclasses import dataclass
from decimal import Decimal
from enum import Enum
from typing import Optional

class SCAExemption(Enum):
    LOW_VALUE = "low_value"           # < €30
    TRUSTED_BENEFICIARY = "trusted"   # Whitelisted recipient
    RECURRING = "recurring"           # Subsequent recurring payment
    LOW_RISK = "low_risk"             # TRA score < threshold
    CORPORATE = "corporate"           # Secure corporate payment

@dataclass
class SCADecision:
    sca_required: bool
    exemption: Optional[SCAExemption] = None
    risk_score: Optional[float] = None
    reason: Optional[str] = None

class SCAExemptionEngine:
    """Determine SCA exemptions per PSD2 RTS."""

    def __init__(self, tra_model, trusted_beneficiary_store):
        self.tra_model = tra_model
        self.trusted_store = trusted_beneficiary_store

        # Fraud rate thresholds for TRA exemption
        self.tra_thresholds =
    def evaluate(
        self,
        customer_id: str,
        amount: Decimal,
        creditor_iban: str,
        is_recurring: bool = False,
        is_corporate: bool = False
    ) -> SCADecision:
        """Evaluate transaction for SCA exemption eligibility."""

        # 1. Low value exemption (< €30)
        if amount < 30:
            # Check cumulative: 5 consecutive or €100 total triggers SCA
            if not self._exceeds_low_value_limits(customer_id, amount):
                return SCADecision(
                    sca_required=False,
                    exemption=SCAExemption.LOW_VALUE,
                    reason=f"Amount €{amount} below €30 threshold"
                )

        # 2. Trusted beneficiary exemption
        if self.trusted_store.is_trusted(customer_id, creditor_iban):
            return SCADecision(
                sca_required=False,
                exemption=SCAExemption.TRUSTED_BENEFICIARY,
                reason="Creditor on trusted beneficiary list"
            )

        # 3. Recurring payment exemption (after initial SCA)
        if is_recurring and self._has_initial_sca(customer_id, creditor_iban):
            return SCADecision(
                sca_required=False,
                exemption=SCAExemption.RECURRING,
                reason="Recurring payment with prior SCA"
            )

        # 4. Corporate exemption (dedicated secure protocols)
        if is_corporate:
            return SCADecision(
                sca_required=False,
                exemption=SCAExemption.CORPORATE,
                reason="Corporate payment with secure protocol"
            )

        # 5. Transaction Risk Analysis (TRA) exemption
        risk_score = self.tra_model.score_transaction(
            customer_id=customer_id,
            amount=float(amount),
            creditor_iban=creditor_iban
        )

        tra_eligible = self._check_tra_eligibility(amount, risk_score)
        if tra_eligible:
            return SCADecision(
                sca_required=False,
                exemption=SCAExemption.LOW_RISK,
                risk_score=risk_score,
                reason=f"TRA score {risk_score:.2f} below threshold for €{amount}"
            )

        # No exemption - SCA required
        return SCADecision(
            sca_required=True,
            risk_score=risk_score,
            reason="No applicable exemption"
        )

    def _check_tra_eligibility(self, amount: Decimal, risk_score: float) -> bool:
        """Check if transaction qualifies for TRA exemption."""
        # Must have fraud rate below threshold for amount tier
        our_fraud_rate = self._get_fraud_rate()

        for threshold_amount, max_fraud_rate in self.tra_thresholds.items():
            if amount <= threshold_amount and our_fraud_rate < max_fraud_rate:
                # Also check risk score - typically need < 30 risk points
                if risk_score < 0.30:
                    return True

        return False

    def _exceeds_low_value_limits(self, customer_id: str, amount: Decimal) -> bool:
        """Check if low-value cumulative limits exceeded."""
        # Get recent low-value transactions without SCA
        recent = self._get_recent_low_value_transactions(customer_id)

        consecutive_count = len(recent)
        cumulative_amount = sum(t.amount for t in recent) + amount

        # PSD2 limits: 5 consecutive OR €100 cumulative
        return consecutive_count >= 5 or cumulative_amount >= 100

if intent.status == 'requires_action':
    # Customer needs to authenticate - redirect to 3DS flow
    return
elif intent.status == 'succeeded':
    fulfill_order(intent.metadata['order_id'])