Drew Edmond’s Post

View profile for Drew Edmond

Merchant, Subscription, and Platform Payments Optimization, Payments Strategy for Fintechs and Solution Providers. Ex-Square, Etsy Payments

𝗪𝗶𝗹𝗹 𝗣𝗮𝘀𝘀𝗸𝗲𝘆𝘀 𝗯𝗲𝗰𝗼𝗺𝗲 𝘁𝗵𝗲 𝗳𝘂𝘁𝘂𝗿𝗲 𝗼𝗳 𝗽𝗮𝘆𝗺𝗲𝗻𝘁 𝗮𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻? Everyone knows that transaction fraud is the bane of our collective existence in the world of online payments acceptance. The latest evolution in this journey to thwart malicious fraudsters from using stolen credentials to make payments is the use of Passkeys. Both Mastercard and Visa are all-in on Passkeys as a method to improve payment authentication in order to increase the security of payments that run over their networks and to reduce the costs of managing fraud for merchants and financial institutions. The focus in Mastercard's latest release is on Europe, as customers already are accustomed to some friction to authenticate transactions in many cases. ❓ What are Passkeys? A Passkey uses a pair of cryptographic keys: a public key stored on the service’s server and a private key stored securely on the user’s device. When a passkey is used to login to a website or to authenticate a transaction, the private key generates a cryptographic signature sent to the server that holds the public key. It can use biometric authentication (e.g., FaceID or fingerprint) to unlock the private key on the device (e.g., phone, tablet, or laptop). ❓ Where are Passkeys in Use Today You may have already started using them to access services like Gmail or your Kayak account. We are starting to see them in the world of payments, for example, the Stripe Link checkout service. ❓ What is the Use Case for Payments? Beyond account access, Passkeys can authenticate individual transactions. When a customer has Passkeys enabled, they can authenticate the transaction using biometrics. Combining Passkeys with tokenization leads to a highly secure transaction, similar to how an Apple or Google Pay transaction works today. Today, this uses the 3D Secure protocol. Mastercard and Visa will include Passkeys in the Click to Pay wallet using 3D Secure. Merchants with cards on file can use Passkeys to authenticate transactions when a cardholder adds a new card and subsequent transactions. ❓ How Will Passkeys Affect Conversion? In places where merchants are not mandated to use multifactor authentication, Passkeys may be used to secure higher-risk transactions or to offer another secure option to customers who don’t use Apple or Google Pay. Using Passkeys also removes the need to log in (and remember a password in the process) to access stored credentials for checkout. ❓ How is this better than One-Time Passwords? Passkeys are resistant to phishing and man-in-the-middle attacks, making them a more secure form of multi-factor authentication.

Jordan Harris

Senior Director, Fraud Prevention at iHerb and Host of Fraud Boxer Podcast

10mo

Yes. Passkeys are 100% the future! Everyone embrace them now! I still think for them to maximize their potential there needs to be a form of liability shift involved though.

To view or add a comment, sign in

Explore topics