Read the full article here
Transforming Payment Authentication with Passkeys
The global payments ecosystem is rapidly evolving in response to rising digital fraud and user demand for frictionless transactions. In card-not-present (CNP) payments, balancing robust security with seamless user experience is critical for success. As a result, payment passkeys — powered by phishing-resistant FIDO/WebAuthn standards — are emerging as a leading solution for secure, passwordless payment authentication.
This article provides a concise overview of the four primary passkey integration models shaping the future of digital payments, comparing their architectures, advantages and strategic implications for issuers, merchants, card networks and payment service providers (PSPs).
Key Payment Passkey Integration Models
- Issuer-Centric Model: Secure Payment Confirmation (SPC) In this approach, the user’s bank (issuer) acts as the primary Relying Party (RP), with passkeys tied to the bank’s domain. When a CNP payment requires additional verification, banks can leverage Secure Payment Confirmation, replacing SMS OTPs or CAPTCHAs with quick biometric approvals. While this model significantly streamlines SCA (Strong Customer Authentication) for both issuers and cardholders, current browser support — specifically by Apple’s Safari — limits its widespread adoption.
- Merchant-Centric Model: Delegated Authentication (DA) Here, merchants become the RP and manage passkey-based logins and payment authentication directly. By verifying users at login, merchants can enable a smooth, secure checkout without interruptions. The login passkey can be used in the checkout process for 3DS. However, this model shifts compliance liability to merchants.
- Network-Centric Model: Click-to-Pay & Federated Passkey Services In the network-centric model, major card networks (like Visa or Mastercard) serve as the RP, offering universal passkey authentication for standardized guest checkouts. This delivers a unified experience across multiple merchants, making payment flows both consistent and secure. The trade-off is reduced control for individual merchants, as key aspects of branding and user interaction shift to the network level.
- PSP-Centric Model: Wallet-Based Authentication Well-established PSPs such as PayPal, Klarna and Stripe Link act as the RP, utilizing passkeys within their wallet ecosystems. Consumers can authenticate across a broad merchant network with a single passkey, enjoying a familiar and reliable checkout experience. This mature model benefits strongly from network effects as more merchants and users participate.
Anatomy of Payment Authentication in CNP Transactions
Effective payment passkey integration requires understanding the parties and data flows in a typical online transaction: cardholders, merchants, issuers, acquirers, card networks, PSPs and Open Banking providers each play a role. EMV 3-D Secure (3DS) adds a critical security layer and passkeys can replace legacy OTPs with a faster, more user-friendly step-up authentication using biometrics or device PINs.
Operational & Strategic Challenges
One critical consideration is passkey portability: passkeys are linked to a specific RP domain, requiring users to register new credentials with each payment entity. Account recovery and cross-platform compatibility are additional challenges to be addressed as the industry matures.
Each model must strategically answer: Who manages authentication responsibility, who retains user trust and how is liability shared? The answers shape business risks, user experience and control over critical payment flows.
Industry Case Studies and Emerging Applications
Leading organizations are already realizing the benefits of passkey authentication. PayPal has demonstrated stronger security and improved user experience through wallet-based passkeys. Card networks such as Visa and Mastercard are pioneering network-centric models, standardizing secure authentication for guest checkouts. Meanwhile, emerging use cases include passkey-based wallet provisioning, open banking consent, instant lending and even secure crypto wallet access.
Outlook: The Future of Payment Passkeys
Industry analysts forecast a shift away from passwords and OTPs, with regulatory trends like PSD3 favoring phishing-resistant SCA methods. Companies best positioned for adoption include issuing banks, ACS providers, large merchants, card networks and consumer wallet PSPs. Technology providers are developing versatile passkey modules, DA solutions and orchestration layers to accelerate adoption and integration across the payments ecosystem.
Find out more about the different payment passkey integration models and how they are shaping the future of secure online payments at: https://www.corbado.com/blog/payment-passkeys-landscape-overview
Top comments (0)