Contributed content: this article was written by a third-party contributor and does not necessarily reflect the views of Financial News. Editorial and Advertising Policy
Here is a small confession. I build and study payments systems for a living, and I still abandon online payments because of one-time passcodes. The text message arrives late. It lands on a phone in another room. Sometimes it never arrives at all. By the time I type six digits, the basket has timed out.
Millions of shoppers live this every day, and most payments teams accept it as the price of security. I think that trade-off has expired. Passkeys give us authentication that is both stronger and faster than the passcode.
Key point from Vladyslav Kolodistyi: passkeys unlocked by device biometrics meet strong customer authentication rules, cut fraud and lift conversion in payments at the same time.
In most payments today, the one-time passcode protects the bank and punishes the customer. Passkeys are the first authentication method that protects both.
Vladyslav Kolodistyi
Why passkeys win at payment authentication
A passkey is an authentication credential built on a cryptographic key pair. The private half never leaves the customer’s device. The phone or laptop unlocks it with biometrics, such as a fingerprint or face scan, or with a device PIN. There is no shared secret to steal, no code to read out and no password to reuse.
That design makes passkeys resistant to phishing by default. A passkey belongs to one domain, so if a fraudster builds a fake bank page, the device simply refuses to sign for it.
The usage data backs it up. The FIDO Alliance Passkey Index, which pools results from Amazon, Google, Microsoft, PayPal and others, reports a 93% sign-in success rate for passkeys against 63% for other methods. Average sign-in time falls to 8.5 seconds, compared with 31.2 seconds for email codes, SMS and similar options.
Passkeys against legacy sign-in methods, FIDO Alliance Passkey Index data. Chart by Vladyslav Kolodistyi.
Thirty points of success rate is not a rounding error in payments. Every failed authentication at checkout is a payment that may never come back.
Network tokens close the other half of the gap. When merchants store tokens instead of raw card numbers, there is little left to steal, a case I made for Socialnomics in a piece on the card number nobody should store. Passkeys protect the moment of payment, and tokens protect everything stored around it.
Do passkeys satisfy strong customer authentication?
In Europe, card and account payments need strong customer authentication under PSD2, which asks for two independent factors from three groups: something you know, something you have and something you are. Passkeys cover this neatly. The device that holds the key is possession, and the biometrics or PIN that unlock it supply inherence or knowledge.
The biometrics template stays in secure hardware on the device. Neither the merchant nor the bank that processes the payments stores the fingerprint. From a data protection view, that beats any central database of biometrics.
Biometrics that never leave the phone are the rare privacy upgrade that also cuts fraud. I would take that deal every time.
Vladyslav Kolodistyi
What passkeys change at checkout
Visa and Mastercard both run payment passkey programmes that bind a card credential to a device. Mastercard has said it wants to phase out manual card entry and one-time passcodes for online payments in Europe by 2030. That signal matters, because merchants and payments providers follow the networks.
At checkout, a returning customer taps “pay”. The browser asks the device to confirm with biometrics, and the signed result travels to the issuer as proof of authentication. No redirect, no text message, no second app, and the payment completes in seconds.
The checkout path with an SMS passcode against the path with passkeys. Diagram by Vladyslav Kolodistyi.
Passkeys also cut fraud and cost. Stolen card data without the customer’s device cannot complete authentication, so the card number loses most of its value on its own. Every SMS passcode costs money to send, and support desks spend hours on customers who never received a code. Stronger authentication evidence also helps merchants in disputes over unauthorised payments.
What merchants need to change
From the projects I have reviewed, the merchants who see real gains in payments conversion do the same handful of things:
- They offer passkey creation right after a successful purchase, when trust is highest, instead of burying it in account settings.
- They keep a fallback authentication path for customers on older devices, so no one gets locked out of payments.
- They work with a payments provider that supports network passkey programmes and passes the authentication result to the issuer.
- They explain in one line that biometrics stay on the phone, which answers the privacy question before customers ask it.
- They track authentication success and checkout drop-off separately for passkeys and passcodes, so the business case stays visible.
Ask for a passkey at the moment of success, not at the moment of friction. Timing decides adoption.
Vladyslav Kolodistyi
When nobody types anything
One more trend makes this urgent. AI agents are starting to make payments on behalf of customers, and an agent cannot read an SMS or type a code. Passkeys and device-bound credentials let the customer approve a mandate with biometrics once, while the agent completes payments inside clear limits. Merchants that build on passkeys today will be ready for agent-led payments tomorrow.
I’m Vladyslav Kolodistyi, and I’m curious how your teams approach passkeys, biometrics and payments at checkout. Let’s connect on LinkedIn and compare notes.
