Visa Passkeys: Visa Payment Passkey Service

The financial services sector and the payment industry is going on all-in on passkeys. After the rollout of passkeys at banks (e.g. Revolut), fintechs (e.g. Finom) or payment providers (e.g. PayPal), and Mastercard’s introduction of their Token Authentication Service roughly one month ago in April 2024, Visa has now introduced their own passkey service called Visa Payment Passkey Service at their annual Payments Forum.

Previously, we have already discussed the implications of this shift in the financial world, in particularly regarding Strong Customer Authentication (SCA), PSD2 and dynamic linking. Read the detailed blog posts here:

• Device-Bound vs. Synced Passkeys
• Analysis of PSD2 & SCA Requirements
• What SCA Requirements Mean for Passkeys
• PSD3 / PSR Implications for Passkeys
• PSD2 Passkeys: Phishing-Resistant PSD2-Compliant MFA
• Dynamic Linking with Passkeys: Secure Payment Confirmation (SPC)

This blog post examines Visa's approach to passkeys and its implications for the future of payment security.

The rise of passkeys in the financial services industry is largely driven by consumer expectations. Recent insights from Visa underscore this trend, revealing that 62% of consumers have abandoned an online purchase due to authentication issues. Moreover, security is a concern: 26% of consumers have admitted to sharing their PIN at some point, highlighting the vulnerabilities of traditional authentication methods. Alarmingly, online payment fraud rates are seven times higher than in-person fraud, further emphasizing the need for more secure digital transaction methods.

Visa's introduction of their Visa Payment Passkey Service marks a significant step towards addressing these concerns. By replacing passwords and one-time codes with passkeys, Visa passkeys streamline online shopping experiences, reducing friction and enhancing security. Passkeys are not only user-friendly but also robust against cyber attacks, such as phishing.

Passkeys present a compelling solution for financial institutions aiming to improve security while simultaneously making the UX better. This technology aligns perfectly with the Payment Services Directive 2 (PSD2) in the European Union, which mandates Strong Customer Authentication (SCA). PSD2 requires transactions to be authenticated using at least two of the following: something the user knows, has, or is. Passkeys meet these criteria by leveraging biometric data (something the user is) and securely stored private keys (something the user has), such as those in a device's secure enclave, Trusted Execution Environment (TEE), or Trusted Platform Module (TPM).

Visa has been an important player in the evolution of passkeys, particularly through its membership in the FIDO Alliance by joining the FIDO alliance in 2014, two years after Mastercard.

One of Visa’s previous services, which could be seen as a predecessor for passkeys, is the Visa Biometric Authenticator App, a restricted product with limited access to its documentation and assets, unfortunately.

In 2019, Visa conducted a study on biometrics and consumer preferences, surveying 1,000 credit card holders in Germany. The findings revealed a strong consumer preference for biometric authentication over traditional passwords. An impressive 90% of respondents considered fingerprints a secure method for identity verification, compared to only 77% for PINs and 73% for passwords. Additionally, methods like iris and facial scans were rated as more secure than PINs and passwords. This probably showed Visa the direction of pushing biometrics, and subsequently passkeys, as the way to go.

At the Payments Forum 2024, Visa officially announced the Visa Payment Passkey Service. Jack Forestell, Visa’s Chief Product and Strategy Officer outlined:

The Visa Payment Passkey Service will first be integrated into Visa’s Click to Pay platform, offering a seamless and secure checkout experience at scale. Additionally, Visa plans to partner with issuers in various markets to enable Click to Pay and the Visa Payment Passkey Service on new Visa cards. This integration will reduce the need for manual entry of card details and passwords from the moment the card arrives, further simplifying the user experience.

Visa’s launch of the Visa Payment Passkey Service is a significant advancement for passkeys in the space of payment, as Visa is the second of the three big credit card issuers to offer a dedicated passkey service.

With the Visa Payment Passkey Service, traditional password-based authentication can be fully replaced. We expect (similarly to Mastercard’s Token Authentication Service) that Visa’s Payment Passkey Service will ensure that once a user has created a passkey at Visa, this passkey can be used to authenticate transactions across any participating merchant's site without the need to create new passkeys each time the user visits a new merchant site.

For merchants, adopting Visa's Payment Passkey Service offers several key benefits:

• Reduced Fraud and Chargebacks: The authentication process leverages the user's biometric data, significantly lowering the risk of fraud and chargebacks.
• Minimized Checkout Friction: A smoother transaction process results in higher approval and conversion rates.

For shoppers, this service provides:

• Seamless Checkout Experience: A streamlined checkout process across various devices and merchants' shops.
• Enhanced Security: Phishing-resistant multi-factor authentication (MFA) bolsters defense against credit card scams and phishing attacks.

We will write a more detailed technical analysis on how to integrate the Mastercard Token Authentication Service into existing system once Mastercard publishes more information. To stay up-to-date, subscribe to our Passkeys Substack or join our Passkey Community on Slack to not miss any update.

Until then, we recommend to take a look at the announcement video by Visa that explains the concept in more detail.

The adoption of passkeys in the payment provider landscape by Visa’s Payment Passkey Service marks another big milestone for the entire industry. This innovative approach not only enhances transaction security through biometric authentication but also offers a seamless and frictionless user experience, addressing two of the most critical aspects in the payment industry today.

For merchants, integrating Visa passkeys means a significant reduction in fraud and chargebacks. For consumers, it promises a more secure and streamlined checkout process. Developers and product managers are encouraged to explore this technology to stay at the forefront of payment security and user experience.

An open question remains: with Visa (and recently Mastercard) embracing passkeys, what is American Express planning regarding passkeys to catch up with Mastercard and Visa?

At Corbado, we are committed to providing the tools and expertise needed to integrate passkeys effortlessly. Stay tuned for more insights and detailed analyses on how passkeys are shaping digital authentication.