What is Fast Identity Online (FIDO)?
The FIDO (Fast Identity Online) Alliance is an open industry association with a mission to reduce the world's reliance on passwords. It provides a set of global standards created to make online authentication easier and more secure. The FIDO standards are used to develop passkeys and other technologies that help protect your online accounts.
For more information on FIDO and passkeys, visit: https://fidoalliance.org.
What are payment passkeys?
Mastercard is introducing payment passkeys to offer a more secure and easy way for cardholders to authenticate themselves during e-commerce transactions. Payment passkeys can be used when checking out using Click to Pay or when you store your card on file with a merchant.
What is a passkey?
Passkeys are a secure way to sign in to websites and apps with biometrics or PIN. Based on Fast Identity Online (FIDO) standards, they provide a faster, easier and more secure method to authenticate your identity using your personal device.
Passkeys are easy to use because they use the same technology you already use to unlock your smart devices. They provide strong protection against online fraud attacks, making them safer than traditional passwords.
What do I need to do before creating a payment passkey with Mastercard?
Creating a payment passkey is simple and secure. First, make sure you’ve added your Mastercard card to a service that saves your card details for easy checkouts, like Card on File or Click to Pay.
Second, ensure you are using a device or browser that supports passkeys. Most modern smartphones and browsers do, but you can check your device or browser settings or visit https://fidoalliance.org for more information.
Lastly, if prompted to create a passkey, confirm your identity with your bank using your device. This step is usually done through your bank’s authentication method such as Identity Check and helps ensure that only you can add your card to your payment passkey.
How do I create and use a payment passkey with Mastercard?
You can create a payment passkey with Mastercard:
- During checkout: If a merchant or payment service provider participates in Mastercard’s Token Authentication Service, you can create a payment passkey when you check out. This may happen when you save your card details for future purchases, using solutions like Card on File or Click to Pay.
- Through your bank: You may also be offered the option to create a payment passkey directly through your Mastercard issuer.
Please note the availability of Mastercard payment passkeys may vary by country and by Bank.
Once you create a payment passkey and it's activated to use with your Mastercard card, you can make secure payments using the biometric authentication mechanism provided by your device operating system, like fingerprint or facial recognition. Your device may also use your personal identification (PIN) or passcode, the same way you unlock your device, for authentication.
Is using payment passkeys secure?
Yes, using a passkey is secure. When you create a payment passkey with Mastercard, you'll first need to confirm your identity with your bank on your device. This helps ensure no one else can add your card to their device. Once you've confirmed your identity and created the passkey, it will be ready to use for payment authentication.
What is a payment passkey profile?
A payment passkey profile is a secure digital profile that links your Mastercard card with your device and passkey to confirm your identity. When you create a payment passkey, you agree to Mastercard’s Terms of Use and Privacy Notice, which then creates this profile.
Your profile includes your linked Mastercard cards and may contain your personal information; for example, your email or mobile number.
What is Mastercard’s Token Authentication Service?
Mastercard’s Token Authentication Service allows participating merchants to confirm your identity using Mastercard payment passkeys during checkout. While merchants may not advertise this service, you'll recognize it when prompted to create or authenticate with your payment passkey during checkout.
Can I link multiple cards to my passkey? How does this work?
Yes, if you're on the same device where you previously created a payment passkey, you can link additional Mastercard cards to your existing payment passkey profile. When adding a new card to your profile, you'll need to verify your identity with your bank. You'll see a prompt to "link passkey" instead of "create passkey" during this process, indicating you're adding a card to your existing payment passkey.
Can I use my payment passkey across different devices (i.e., mobile phone, computer, etc.)?
To use Mastercard payment passkeys on a different device, you'll first need to verify your identity with your bank on the new device. This helps keep your payment passkey secure.
For more details on passkey security and syncing across devices, check with your Operating System (OS) provider (i.e., Apple, Android, Microsoft, etc.).
How do I delete my payment passkey and/or Payment Passkey Profile?
To remove a passkey from your device, consult with your device Operating System (OS) provider. The private key associated to your payment passkey is stored on your device and can be accessed through your device settings.
To delete your payment passkey profile, contact Mastercard via Mastercard’s My Data Portal to submit a request to delete your profile.
What should I do if my Mastercard card is lost or stolen, and the bank replaces my Mastercard card? Or if I close my Mastercard card account?
If your bank replaces your Mastercard card because it was lost or stolen, your physical card number will change. If you use this card online, you’ll either need to create a new payment passkey with Mastercard or link the new card to your existing payment passkey profile. However, no additional action is required on your end. You’ll be prompted to set up your new card or payment passkey the next time you use your new card at a participating merchant. Mastercard will also remove the old card from your payment passkey profile once the card account is closed.
If you close your Mastercard card account and it’s linked to your payment passkey profile, you have the option to delete the payment passkey locally in your device settings. However, if you have multiple Mastercard cards connected to the same payment passkey, local deletion of the payment passkey will not allow you to continue using that deleted payment passkey for the multiple cards. Alternatively, Mastercard will remove the Mastercard card from your payment passkey profile once the card is closed or after 13 months of inactivity.
Are all my Mastercard cards eligible for payment passkeys?
Your eligibility to create a payment passkey with your Mastercard depends on your country of residence. Mastercard payment passkeys are available in select countries, as indicated in our Terms of Use.
What should I do if I lose or change my device?
If you switch your mobile device or changed to a different device OS provider, you’ll need to create a new passkey on the new device. It’s recommended to remove your passkeys and any login details from your old device. Please note, if your payment passkey profile is inactive for 13 months, it will be deleted. You can also delete your profile through Mastercard’s My Data Portal if you lose access to your old device.
If your payment passkeys are still on your old device and someone else can unlock it, like with a PIN code, be sure to delete your passkeys.
Can I use payment passkeys on a shared device?
You can create a passkey on any FIDO-supported device. When you create a payment passkey with Mastercard, you are agreeing that only you can access this device. Mastercard payment passkeys Terms of Use indicate that you shouldn’t use this service on shared devices.
Does Mastercard store my biometric information?
No, your biometrics only unlock your device to access secure payment information linked to Mastercard.com. If you use biometrics, your data stays on your device and is never shared.
For more detailed information on how Mastercard processes your data for this service, consult the Privacy Notice.
What if I changed my phone number? Do I need to delete my payment passkey?
For additional security, you may have a phone number associated with your payment passkey profile; however, to access your payment passkey you need your biometrics on your mobile device therefore, if your phone number changes there is no action for you to take and there is also no security threat.
Does the merchant have access to my payment passkey when I shop?
When a merchant lets you authenticate your payment with your Mastercard payment passkey, they’ll get a notification that you’ve authenticated the transaction, using your passkey. The merchant does not have access to any details associated with your passkey and your biometrics never leave your device.