Visa Payment Passkey: Will It Replace SMS Codes at Checkout, and When?
By Yan Payments
Is Visa replacing SMS codes at checkout with fingerprint or face scans?
Yes, that product exists and processors are turning it on, but not for US merchants yet. Visa Payment Passkey is live or rolling out in the UK, parts of Europe, India, and the Middle East. There’s no announced US timeline as of this writing, so if you sell online in the US, this is a watch-for-it story, not something you can switch on this quarter.
What is Visa Payment Passkey, actually?
It’s a way to authenticate a card payment using the device the shopper is already holding, instead of texting them a one-time code. Visa announced it in May 2024, built on FIDO and WebAuthn, the same open standards behind the passkeys people already use to log into apps with Face ID or a fingerprint.
Under the hood, it sits on top of two things Visa already runs: network tokenization, which replaces the actual card number with a token so the real number never has to travel across the internet again, and Click to Pay, Visa’s existing one-click checkout rail. The first time a shopper buys from a passkey-enabled merchant, they still go through a normal step-up check, usually 3-D Secure. If that succeeds, a passkey gets registered to their device. Every purchase after that, at any merchant using the same system, the shopper just unlocks their phone with a face or fingerprint scan instead of waiting for a text message that may or may not arrive in time.
Where is it actually live right now?
Checkout.com and Adyen, two large payment processors, have both turned it on. What matters more for a US merchant is where: Checkout.com’s rollout is UK and Europe. Adyen announced its version on October 29, 2026, through a module called Authenticate inside its Uplift product, also UK first, with global expansion planned for 2027, per Adyen’s own announcement.
Outside of Europe, the clearest live deployments are in India, where IDFC First Bank turned it on in July 2026, and the Middle East, through a partnership with Noon Payments. None of the public announcements name a US acquirer, bank, or merchant program, and nobody involved has published a US launch date.
Does it actually cut fraud, or is that just a marketing number?
Visa itself says biometric authentication through Payment Passkey runs about 50% lower fraud rates than SMS one-time codes, based on Visa’s own network data from July through December 2023. That’s worth knowing, but it’s Visa’s number from Visa’s own data, not an independently audited study, so treat it as a vendor claim rather than a settled fact. The underlying logic is reasonable regardless: SMS codes can be intercepted through SIM swaps or phishing, and they routinely get delayed or lost, which is also why a meaningful share of cart abandonment at the OTP step isn’t fraud prevention working, it’s a real customer giving up because the text didn’t show up.
Should a US merchant do anything about this right now?
Not urgently. If you run your own checkout and rely on 3-D Secure with SMS one-time codes for card-not-present sales, nothing about your setup needs to change today, because there’s no US rollout to opt into yet. What’s worth doing is low-effort and forward-looking:
- Ask your payment processor whether they have a stated timeline for supporting Visa Payment Passkey or FIDO-based authentication in the US.
- If you’re shopping for a new processor or e-commerce platform anyway, ask about passkey and FIDO support as one factor.
- Don’t rebuild your checkout flow around SMS OTP as a long-term architecture if you’re building something new.
This is a case where the right move is patience, not a redesign. US rollout will likely follow the same path Click to Pay and tokenization took: Europe and large markets first, US processors adding support over the following one to two years. If you’re weighing a new processor for your online store, it’s worth talking to a payments expert about what’s actually supported today versus what’s still a roadmap item.
Sources
← Back to all posts