What Is a Passkey in Payments? Understanding Mastercard's and Visa's Approach

Most online checkouts still ask for a card number, then send an OTP by text message and make the shopper wait for it. That OTP step is also the weakest link in the whole transaction. It can be intercepted, phished, or read out by someone pretending to be their bank. Mastercard and Visa have both built a replacement called a payment passkey. It's not a new invention. It's the existing passkey standard, aimed specifically at authorizing a card transaction instead of logging into a website.

This article answers one question: what is a passkey, in the specific context of paying with a card, and what actually happens when one authenticates a transaction.

What Is a Passkey?

A passkey is a credential built on the FIDO (Fast Identity Online) standards and the WebAuthn protocol. There's no password to type and no shared secret sitting on a server. Instead, a passkey is a cryptographic key pair.

The private key stays on the user's own device, phone, laptop, or tablet. A fingerprint or face scan unlocks it. The public key gets registered with whatever service the person is authenticating to. To authenticate, the device answers a cryptographic challenge with the private key. The biometric check is what unlocks that key locally, nothing more.

That's the whole trick, and it's why passkeys resist phishing. There's no code to trick someone into reading out loud, and no password database to steal, because the private key never leaves the device.

Passkeys were built first for logging into apps and websites. Mastercard and Visa took that same mechanism and pointed it at a narrower job: approving a payment.

What Makes It a Payment Passkey

A login passkey proves one thing: this is the right device, unlocked by the right person. A payment passkey has to prove something more specific. It has to show that the person approved this exact transaction, this amount, to this merchant, not just that they're logged in somewhere.

That distinction comes from payment regulation, not from engineering preference. Under rules like Europe's PSD2 Strong Customer Authentication requirement, an authentication method used for a payment needs dynamic linking. The authentication has to be cryptographically tied to the transaction details themselves. So when a payment passkey signs off on a purchase, the signature covers the amount and the merchant. A login passkey never has to do that.

Strip away that one requirement, and a payment passkey is just a passkey. Same FIDO/WebAuthn foundation, same on-device private key, same biometric unlock.

How Authentication Actually Happens

Here's the authentication step on its own, without the marketing layer around it:

1. Enrollment. A cardholder registers a payment passkey. Their bank confirms identity first, then binds the passkey to their card and device.
2. Challenge. At checkout, the system sends a cryptographic challenge that includes the transaction amount and merchant.
3. Biometric approval. A fingerprint or face scan unlocks the private key on the device, which signs that challenge.
4. Verification. The bank checks the signature against the registered public key. No password. No OTP.

There's also an unfinished variant called Secure Payment Confirmation, or SPC. It would show the challenge in a browser pop-up on the merchant's own page instead of redirecting the shopper elsewhere. It's still a concept. Not every browser or OS vendor has committed to supporting it, so general availability is uncertain.

Mastercard and Visa: Two Names, One Standard

Mastercard calls its version the Mastercard Payment Passkey Service. Visa calls its version the Visa Payment Passkey Service. The names are close enough to look like copying, but that's the point: both run on the same FIDO/WebAuthn foundation and the same dynamic-linking requirement described above. Neither network invented its own cryptography here. A payment passkey is a shared industry standard, and each network just put its own name on its implementation.

Where the Technology Still Has Limits

A payment passkey is device-bound. Lose the phone, and the passkey doesn't travel with you automatically. Recovery means re-enrolling, and that process is still being worked out across issuers.

SPC and other newer flows depend on browser and OS support that isn't consistent yet. Some platforms have it. Others don't.

And a payment passkey only replaces the authentication step. It doesn't touch the card, the account, or the rails the money actually moves on. It's a better way to prove it's you approving the charge, not a new way to pay.

Conclusion

A payment passkey is the same cryptographic mechanism used to log into an app: a private key on the device, unlocked by biometrics, that never leaves the hardware it lives on. What separates it from a login passkey is dynamic linking, the requirement that ties the signature to the exact transaction rather than just the user's identity. Mastercard and Visa each built their own branded service around that requirement. Different names, same standard underneath.