SMS OTP authentication takes 20 to 45 seconds — the wait for the message, the context switch, the manual entry. Passkey authentication takes 3 to 8 seconds. A different category of experience, and a different conversion outcome.
Passwords and SMS codes can be phished. A passkey is cryptographically bound to your service's domain, it cannot be entered on a fake website because it does not work anywhere except the legitimate service it was created for. Phishing-resistant by design.
PSD2's dynamic linking requirements are satisfied by Secure Payment Confirmation (SPC). PSD3 is pushing further in the same direction. Getting ahead of that now means not reworking it when the next mandate arrives.
Replace SMS one-time passwords in EMV 3DS challenge flows with passkey authentication. Customers authenticate with biometrics instead of waiting for SMS codes — reducing authentication time from 20-45 seconds to 3-8 seconds. Fewer abandoned transactions. Lower SMS delivery costs.
Secure merchant portal access with phishing-resistant passkey authentication. When merchants authenticate their customers with FIDO, that data can be passed as a trust signal in 3DS requests, driving frictionless approvals downstream.
Support Secure Payment Confirmation (SPC) and Click to Pay passkey integration. Align with the strategic direction of the major card networks that actively deploy passkey-based authentication services — ahead of new regulatory requirements rather than reacting to them.
Passkeys are the authentication method the regulatory and technical ecosystem is converging on. Deploying now means building on a foundation that regulators are mandating and card networks are embracing, not one that will need replacing in a couple of years.
90% faster than SMS OTP Passkeys replace SMS one-time passwords in EMV 3-D Secure challenge flows. When an issuer's Access Control Server requires step-up authentication, customers authenticate with biometrics instead of waiting for an SMS code. The challenge step does not disappear; it just stops being the reason customers abandon.
Best for: issuers and their ACS challenge flow. Available via G+D Netcetera’s 3DS Passkey Server.
Secure Payment Confirmation (SPC) SPC is a W3C standard designed for payment authentication using FIDO and WebAuthn. Transaction details — amount, merchant, payee — are displayed in a browser-native dialog with passkey authentication, meeting dynamic linking requirements. The customer sees exactly what they are authorizing and authenticates with a biometric.
Best for: PSPs and payment networks preparing for PSD3, without the UX cost of legacy challenge flows.
Conversion lift through trust signals When merchants use passkeys for account login, that data can be passed to issuers as a strong trust signal. Issuers who receive it can approve transactions frictionlessly, without an additional challenge step, because the customer has already authenticated at a higher standard than an SMS OTP.
Best for: PSPs improving frictionless approval rates for their merchant customers.
Transaction authentication within Click to Pay Skip 3DS entirely and authenticate with a biometric passkey instead — Face ID, fingerprint, done. The challenge step disappears, the customer stays in the checkout flow, and the transaction moves straight to authorization. A Click to Pay experience that delivers on the 'one click' promise without compromising on security.
Best for: PSPs and merchants running G+D Netcetera's Click to Pay SRCI.
Admin, consumer portals, and mobile apps Passkeys work wherever password-based authentication is currently used. Secure administration access for internal and partner-facing portals. Consumer portal login for self-service banking. Mobile app authentication that replaces PIN entry with a biometric gesture. Each integration point removes a password-based attack surface.
Best for: institutions eliminating passwords beyond the payment transaction itself.
Biometric authentication completes in 3 to 8 seconds. No SMS to wait for, no code to type, no app to switch to. The payment completes in the same gesture that unlocks the phone — the experience customers expect, now the one they can have.
Passkeys work on the devices customers already carry — iPhone, Android, any modern device. No new app to download, no new account to create. One biometric gesture and they are authenticated. Their private key never leaves their device.
Passkeys synchronize securely across a customer's devices through Apple iCloud Keychain or Google Password Manager — using end-to-end encryption. Losing a phone does not mean losing access. Recovery goes through the device account, not a vulnerable password reset.
When a user registers, their device generates a unique cryptographic key pair. The private key stays securely on the device — it is never transmitted and never stored on a server anywhere.
The public key is registered with your service. This key pair is unique to the combination of user, device, and service, which is exactly what makes it useless to an attacker anywhere else.
When the user authenticates, their device uses the private key to sign a challenge from the server. The user proves they have physical possession of the device — confirmed by biometric verification (fingerprint, Face ID) or device PIN.
No password is transmitted. No code is sent. Nothing is shared that could be intercepted, replayed, or phished.
Modern passkey implementations support synchronization across a user's ecosystem — Apple iCloud Keychain, Google Password Manager — through end-to-end encryption.
If a user loses their device, recovery happens through their device account, not through a vulnerable password reset flow. Security is maintained throughout because the keys themselves are never exposed during sync.
Passkey authentication integrates directly into transaction flows. Major card networks including Visa and Mastercard are actively deploying passkey-based authentication services, replacing vulnerable SMS OTPs with phishing-resistant biometric authentication. For payment service providers, issuers, and merchants, passkeys offer multiple integration points across the payment ecosystem — from 3-D Secure authentication to Click to Pay checkout experiences.
Passwords are shared secrets — the server stores a version of your password, and the user transmits it during login. That creates two attack surfaces: the server database and the transmission channel. Passkeys eliminate both. Nothing is stored on the server except a public key, which is useless without the corresponding private key on the user's device. Nothing is transmitted during authentication except a signed cryptographic challenge — which cannot be replayed or used elsewhere. A passkey cannot be guessed, stolen from a database, phished, or reused. Passwords can be all four
Yes — and they are more secure than the SMS OTP methods they replace. The private key never leaves the user's device. The passkey is cryptographically bound to the specific service domain, making phishing attacks structurally impossible. Biometric verification adds a possession factor that an SMS code does not provide. Major card networks are deploying passkey-based authentication specifically because the security profile is stronger than existing methods. Financial regulators increasingly treat FIDO2-based authentication as meeting SCA requirements under PSD2 — with PSD3 reinforcing this direction.
Yes. Passkeys built on FIDO2 and WebAuthn are designed to meet SCA requirements under PSD2, including the dynamic linking requirement when implemented via Secure Payment Confirmation (SPC). SPC displays transaction details (amount, merchant, payee) within the biometric prompt, satisfying the requirement that the authentication be bound to the specific transaction. PSD3 is expected to strengthen SCA requirements further in the same direction that passkeys already satisfy. Deploying passkeys now means building on a regulatory-aligned foundation rather than retrofitting for future mandates.
Passkeys integrate with 3DS at three points. First, as a challenge flow replacement: when the ACS requires step-up authentication, it triggers a passkey challenge instead of sending an SMS OTP — reducing authentication time from 20-45 to 3-8 seconds. Second, via Secure Payment Confirmation (SPC): transaction details are shown in a browser-native passkey dialog, meeting dynamic linking requirements. Third, as a frictionless risk signal: when merchants use passkeys for customer login, that data can be passed in the 3DS request, enabling issuers to approve transactions without a challenge step. G+D Netcetera's 3DS Passkey Server handles the first and third; SPC is handled at the browser layer.
Passkeys support account recovery through the user's device ecosystem account — Apple ID, Google Account, Microsoft Account. Passkeys can be synchronized across a user's devices through platform keychains (iCloud Keychain, Google Password Manager) using end-to-end encryption, so losing one device does not mean losing all passkeys. For financial institutions, recovery flows can be designed to match existing identity verification processes — the passkey enrollment is re-established after identity is confirmed, without requiring a vulnerable password reset flow. The private keys themselves are never exposed during synchronization or recovery.
Find out how leading financial institutions implement passkeys, navigate regulation, and measure the results.
Learn how passkeys work, why they improve security, and how they drive better user journeys and higher conversion rates.
Passkey authentication within Click to Pay eliminates the 3DS challenge step entirely — the customer authenticates biometrically and the transaction moves straight to authorization.
Passkeys secure the identity verification, tokenization secures the payment credential. Together they cover authentication and data protection across the e-commerce transaction.
Modern fraud prevention for issuers, combining the latest EMV 3-D Secure standards, broad multi-scheme certification, and intelligent risk-based authentication.
First-party misuse is now the world’s leading type of fraud, yet it is almost impossible to spot at checkout. Discover why friendly fraud is rising, what it costs the payments industry, and how better data sharing could help distinguish genuine disputes from deliberate abuse.
G+D Netcetera wins two Juniper Awards 2026 for fraud prevention and digital wallets, as banks rethink their systems landscape for future payments
3DS and SCA are working as designed. So why is UK payment fraud still rising?
This free on-demand webinar with G+D Netcetera and The Payments Association UK explores why 3DS alone is no longer enough, and how banks can use earlier intervention, cross-channel intelligence and secure data sharing to make fraud prevention more proactive.
G+D Netcetera Becomes an Official AWS Partner, Strengthening Cloud-Based 3DS Solutions
Your Essential Introduction to Passwordless Authentication. Tired of password resets, phishing attacks, and frustrated customers? It's time to discover passkeys—the authentication technology that's making passwords obsolete.
Payment trends for 2026: digital identity wallets, network tokenisation, AI fraud prevention, VRPs, embedded finance and payment orchestration.
In our latest podcast episode, payment network expert Michael Schoch explains how Secure Remote Commerce (SRC) is creating new growth opportunities for domestic card networks.
This Tech Tribe episode gives a rare look into how advanced fraud prevention works when every second counts — and how the right expertise can turn a crisis into a controlled situation.
CEO Carsten Wengel sits down with Martina Forster, Portfolio Owner for Secure Digital Payments at G+D Netcetera, to explore the evolving world of digital payments: from 3-D Secure to instant payments, Big Tech, and digital identity.
Protecting the business and customers from invisible threats
Make Instant Payments a success with G+D Netcetera, as your strategic partner
Remember the last time you abandoned a purchase because you couldn’t find your card? How much time, energy, and mood did you waste filling in the requested information? Ultimately, you just left your purchase because it was too time-consuming, data-consuming, and energy-consuming. Sound familiar? That’s exactly why Click to Pay was created. In this episode with Suzana Kordumova Nikolova, we explore what makes Click to Pay different from Apple Pay and Google Pay, how it enhances security, and why businesses adopt it.
Passwords are becoming a thing of the past. Passkeys deliver a safer, faster, and more seamless way to log in and approve payments. Payment expert Nakjo Shishkov explains how passkeys, 3DS, Click to Pay, and FIDO authentication set new standards for secure digital experiences. Learn how passkeys work, why they improve security, and how they drive better user journeys and higher conversion rates.
Wach the Click to Pay webinar featuring G+D Netcetera, Worldline, and Visa experts.
Maximizing Trust and Efficiency: G+D Netcetera expands ISAE 3402 certification to cloud services
Partnership with Klar fuels Mexico’s e-commerce boom
