Mastercard takes on UPI with new biometric payment passkey in India

Mastercard has chosen India as the launchpad for its Payment Passkey Service, a new way of conducting online transactions, marking a significant step in the global payments landscape.

The new service will initially pilot in India with some of the country’s largest payment players, including payment aggregators such as Juspay, Razorpay, and PayU, along with major online merchants like bigbasket and leading banks such as Axis Bank, Mastercard said in a statement.

Unlike traditional one-time passwords (OTPs), which have become increasingly vulnerable to phishing, SIM swapping, and message interception, payment passkeys utilize biometric data stored on a user’s device to authenticate transactions. This not only speeds up the checkout process but also adds a layer of security that is believed to be much harder for fraudsters to bypass.

The company said this service, announced at the Global Fintech Fest in Mumbai, is “designed to enhance the security and ease of online shopping” by leveraging biometric authentication and tokenization.

“By introducing the Mastercard Payment Passkey Service in India, we’re advancing secure online checkout and our vision for a token economy,” Mastercard’s chief product officer, Jorn Lambert said in the statement. “Through innovative technology that enhances security and convenience, we’re creating a more transparent commerce ecosystem for all.”

Mastercard had announced Payment Passkey service, part of its Biometric Authentication Service, in January this year, but the service had not been rolled out into its operating markets before now.

Why India?

India’s digital payment ecosystem is one of the fastest-growing in the world, driven largely by the government’s push for a cashless economy and the meteoric rise of the Unified Payments Interface (UPI). UPI has revolutionized digital transactions in India by providing a real-time payment system that has quickly gained popularity among consumers and merchants alike.

As of 2024, UPI transactions have soared to over 10 billion per month, dominating the digital payments market and posing a competitive threat to traditional payment networks like Mastercard and Visa.

“Mastercard’s decision to introduce its Payment Passkey service first in India is a strategic move that aligns with several key market trends and opportunities,” Pranati Dave, practice director at Everest Group, said. “India is one of the world’s fastest-growing digital payment markets, with a rapidly expanding user base for online and mobile transactions.”

“By launching Payment Passkey in India, Mastercard is positioning itself to capture a significant share of this burgeoning market,” Dave added.

While Mastercard and Visa charge fees to merchants for processing payments, UPI, which was created by a group of banks and is overseen by the Reserve Bank of India, lets merchants process transactions for free. This is a compelling reason for Indian users to use UPI instead of Visa or Mastercard, thus threatening the growth of these service providers.

“It is an incredibly painful experience for ecosystem participants who all end up losing money as part of that proposition,” Mastercard CFO Sachin Mehra once said during a conference, while praising India’s UPI.

With the increasing adoption of digital payments, however, comes the heightened risk of online fraud. According to the Reserve Bank of India’s Annual Report for 2023-2024, fraud cases in digital payments have surged by nearly 300% in the last two years. This growing threat has made it imperative for companies to innovate around payment security.

“The service also enhances security with features like tokenization and biometric authentication, which are crucial for Indian consumers increasingly concerned about digital fraud,” Dave said.

Mastercard’s Payment Passkey Service, with its use of device-based biometric authentication such as fingerprints or facial recognition, promises to address these security concerns, providing consumers with a more secure and seamless online checkout experience.

Navigating a competitive and complex market

The launch of the Payment Passkey Service in India is a strategic move for Mastercard as it navigates a market dominated by the UPI system, with its zero-fee model for most transactions. This model has been a disruptive force, prompting traditional payment networks to innovate and offer more secure, value-added services to maintain their market position.

“Moreover, being the first to launch Payment Passkey in this key market gives Mastercard a considerable advantage over competitors who may be slower to adopt similar technologies,” Dave pointed out.

According to Dave, early adoption and success in India are likely to strengthen Mastercard’s brand loyalty among consumers and businesses, establishing it as the preferred choice for secure digital payments.

The new service also aligns with India’s regulatory push for safer digital transactions. The Reserve Bank of India has been proactive in promoting technologies that enhance security, and Mastercard’s biometric-based solution fits well within this framework.

Despite this, Dave said, “privacy concerns and the need to educate a diverse population about biometric security may also hinder adoption. Additionally, navigating regulatory requirements and obtaining approvals from the Indian government could pose further obstacles.”

The Road Ahead

Following the initial pilot program in India, Mastercard plans to roll out the Payment Passkey Service to more consumers and financial institutions globally in the coming months, the statement said.

As the battle for supremacy in the digital payments space intensifies, Mastercard’s Payment Passkey Service could set new benchmarks for security and efficiency, offering a compelling alternative to existing payment methods and potentially reshaping the future of digital transactions.

“However,” Dave said, “Mastercard’s key challenges will be addressing digital infrastructure gaps and limited device compatibility in India. Many areas still lack the necessary infrastructure for widespread biometric use, and not all devices have advanced biometric sensors.”