Mastercard Rolls Out Biometric Authentication Mandate Ahead Of European Regulations

Mastercard money

Sometimes eCommerce retailers need to verify a customer’s identity at checkout, but the authentication process often leads to lost sales. Methods like a one-time password sent by text message (SMS), for example, can cause many consumers to abandon their online shopping carts.

Customers are more inclined to go through with a purchase when retailers use alternate authentication methods. Abandonment rates can drop by up to 70 percent when retailers offer biometric verification instead, according to an announcement from Mastercard.

In combination with the impending rollout of PSD2 in the European Union that will allow external third parties to access customers’ bank accounts with their permission, Mastercard announced earlier this week (Jan. 23) that its issuers must offer biometric identification to its account holders by April 2019.

Mastercard’s EMEA Lead, Identity Solutions, Michael Sass told PYMNT’s Karen Webster that the company did not take the decision lightly. “It was a bold move, and we thought long and hard about it, but we felt that the regulation — the PSD2 RTS [Regulatory Technical Standards] — would require most eCommerce transactions to be authenticated,” Sass said.

While currently only a quarter of eCommerce transactions require authentication today, Sass said that percentage will double or triple once RTS kicks in. If the same abandonment rates are applied to increased eCommerce volume, merchants could miss out on a significant amount of lost revenue.


Not a New Concept

Biometric authentication is not an entirely new concept, with financial institutions already implementing this technology into their software. “Many banks already provide biometric authentication for their online banking apps,” Sass said. “And there [are] more and more devices supporting biometric authentication and more of our customers are using it.”

In the U.K., for example, 27 percent of smartphones have a fingerprint sensor. And 70 percent of consumers there use the feature when it’s available on their phones.

“It’s not yet on every device, but when it’s there … the vast majority use it, which really highlights that customers feel comfortable using fingerprint and biometric authentication,” Sass said, adding that Mastercard has seen similar adoption rates when banks offer Touch ID for opening a banking app. “It shows you that the market is ripe for adopting biometric authentication.” 

Mastercard offers biometric identification through Mastercard Identity Check in 37 countries, which enables individuals to use biometric identifiers, such as fingerprint, iris and facial recognition, to verify their identities when using a mobile device for online shopping and banking.

Research shows that 93 percent of consumers prefer using biometrics over passwords for authenticating payments, while 92 percent of banking professionals say they want to utilize it.  

Yet not all consumers have access to a smartphone that provides this technology — or even a smartphone at all — so Mastercard is asking banks to support another authentication method in addition to biometric verification, such as a passcode.


Time Is Right

As the European Union embraces adoption of PSD2 — and RTS — Mastercard believes the rule will be likely published in March, with its effective date in Sept. 2019. And once PSD2 and RTS are live, banks may need to make some changes.

“Banks will need to think about how to comply, which for many will mean changing their existing authentication method, because many still use static passwords, for example,” Sass said.

The technology is also becoming more widespread — and accurate. Before 2017, that false-positive rate for Touch ID — or the equivalent on Android phones — was at one in 50,000. But, with the advent of iris scanning and FaceID, those odds have improved dramatically: Their false-positive rate is one in a million, “which is quite low,” Sass said.

“That’s a significant improvement, and I [would] personally not be surprised if we have similar improvements in the coming years,” Sass said. “Maybe not all in 2018, but I’m sure in 2019, 2020, there’ll probably be a wave of new, exciting, biometric technologies.



Banks, corporates and even regulators now recognize the imperative to modernize — not just digitize —the infrastructures and workflows that move money and data between businesses domestically and cross-border.

Together with Visa, PYMNTS invites you to a month-long series of livestreamed programs on these issues as they reshape B2B payments. Masters of modernization share insights and answer questions during a mix of intimate fireside chats and vibrant virtual roundtables.