Visa passkeys go live in India as IDFC First Bank becomes first issuer

Visa Payment Passkey allows cardholders to authenticate online transactions using biometrics, PINs, passwords or patterns instead of traditional one-time passwords

Global card network Visa rolled out its one-time password (OTP)-less payment authentication feature, Visa Payment Passkey, on Thursday, with IDFC First Bank becoming the first regulated entity to go live with the solution.

 

A passkey enables cardholders to authenticate transactions using mechanisms such as biometrics, including fingerprints and facial recognition, PIN, password or pattern.

 

It is expected to improve payment success rates and reduce the number of steps required to complete an online transaction compared with traditional OTP-based methods, the company said.

 

More banks are expected to roll out the solution this year.

 

In a statement, Visa said the solution was available for select users of merchants such as Myntra, Paytm, MakeMyTrip, Tata Starbucks, Reliance Digital and EatSure, operated by Rebel Foods, along with fintech partners Juspay, Wibmo, Razorpay, PayU, Pine Labs, BillDesk, M2P Fintech and Paytm Payments Services, among others.

 

 

“Combined with tokenisation, this solution adds an important layer of protection, reduces friction and strengthens trust at every checkout. It also lays the foundation for the next era of agentic commerce, where trusted credentials and strong authentication will enable intelligent digital experiences to act safely on behalf of consumers,” said Suresh Sethi, Group Country Manager, India & South Asia, Visa.

 

The solution requires a one-time setup. It is compatible with major operating systems and browsers and is supported by billions of FIDO, or Fast Identity Online, enabled devices globally, ensuring broad accessibility and scalability, Visa said.

 

Mastercard is also introducing passkeys as a mode of payment authentication, Business Standard reported in February.

 

The rollouts also follow the Reserve Bank of India’s (RBI’s) guidelines issued last year that require at least one of the two factors of authentication to be dynamically generated or proven, paving the way for biometric verification.

 

Passkeys are also expected to curb fraud arising from social engineering, while improving transaction success rates by 2-3 per cent by removing SMS-based authentication friction.

 

Beyond fraud, the friction caused by SMSes also leads to delays in processing transactions, which are eliminated when biometrics are used to authorise a payment.

 

The technology is enabled through integration among card networks, issuers, payment aggregators and merchants.

 

In a passkey-based payment flow, a user’s biometric unlocks a private key stored securely on the device. This signs a one-time challenge from the issuer, which the bank verifies using a corresponding public key before authorising a card payment.