Visa expands payment passkeys, from issuer rollout to AI agent commerce

Visa is expanding the use of payment passkeys across digital commerce with an issuer infrastructure in Asia Pacific, an online checkout in India, and agentic payments in Europe.

Thales has become the first technology partner in the APAC region to join the Visa Digitalization Ready Program (VDRP) to help banks and card issuers deploy next-generation digital payment services more quickly.

The rollout will focus on Click to Pay and payment passkeys, with Thales supporting the implementation through its D1 card issuing platform. Thales will provide the infrastructure needed to make passkey-based checkout authentication easier for financial institutions to deploy.

Visa also launched Payment Passkey in India with IDFC FIRST Bank to allow cardholders to approve online payments using their phone’s native security features the instead of entering a one-time password.

In Europe, Visa along with its partners completed a live AI agent-driven payment transaction in Germany to showcase authentication of the purchase intent using Visa Payment Passkeys.

Thales supports APAC issuer rollout through D1

The Thales announcement comes as banks and payment providers look to accelerate online checkout without weakening payment authentication. The existing methods of manual card entry, passwords, and one-time passcodes add friction for consumers and create gaps that enable phishing and fraud.

Matt Charpentier, vice president and global head of authentication, identity and tap at Visa, said that payment passkeys allow consumers to authenticate a payment much like they unlock a phone, using a fingerprint or facial scan. At the same time, biometric data stays on the device.

Click to Pay and payment passkeys sit at different points in the payment flow. Click to Pay is the checkout layer that reduces the need for shoppers to manually enter card details during online purchases. Visa says that Click to Pay is token-based, which allows merchants to use tokenized payment credentials.

Payment passkeys are the authentication layer that confirms the person making the payment is the legitimate cardholder. Visa describes a payment passkey as a biometric authentication method that replaces passwords and SMS one-time codes with a secure passkey stored on the cardholder’s device.

The challenge for issuers is to connect these secure methods to cardholder systems, digital issuance flows, tokenization services, and customer enrollment processes. These integrations take longer when institutions use older payment infrastructure.

Thales describes D1 as a cloud-native platform for modern, instant card issuance. It is based on token-centric services and API integrations that help issuers add new digital payment capabilities without having to build every integration from scratch.

Last year, ZA Bank became the first issuer in Hong Kong and across Asia Pacific to allow Visa Click to Pay as a standard card feature. Visa said ZA Bank cardholders could set up a Visa payment passkey using their device’s biometric capability or screen lock and then use it for future payment authentication at select e-commerce platforms.

Visa launches Payment Passkey in India with IDFC FIRST Bank

Visa has launched Payment Passkey in India with IDFC FIRST Bank as its first issuer partner. The service allows cardholders to approve online payments using the native security features of their phone, such as fingerprint recognition, facial recognition, PIN, password, or pattern.

The rollout will reduce customer checkout friction while keeping payment authentication tied to the cardholder’s device. This is critical because OTPs remain a common part of online card authentication in the region.

Economic Times reports that the service is being introduced for select users across top merchants, including Myntra, Paytm, MakeMyTrip, Tata Starbucks, Reliance Digital and EatSure. Payment and technology partners are Juspay, Wibmo, Razorpay, PayU, Pine Labs, BillDesk, M2P Fintech, and Paytm Payments Services.

Payment passkeys enter agentic commerce tests in Europe

Visa is also testing payment passkeys in agentic commerce. Worldline, ING, and Visa completed a live end-to-end agent-driven payment transaction in Europe. In the transaction, a consumer gave the conditions for a purchase, including what to buy and when. A merchant AI agent then acted within those boundaries and identified a product for purchase.

The user authenticated the purchase using Visa Payment Passkeys. The transaction was confirmed through biometric authentication, which was authorized by ING and processed end-to-end across Worldline’s infrastructure. The companies say the transaction shows how an AI-enabled payment process can operate within existing regulatory requirements, including Strong Customer Authentication.

“ING and Worldline are now part of our Agentic Ready program. We are supporting real-world testing of how AI-enabled experiences can help consumers shop and pay within clearly defined parameters and established payment controls,” says Mathieu Altwegg, head of Product & Solutions at Visa Europe.

An AI agent may handle part of the shopping journey on the consumer’s behalf, but this makes authentication more important. The payment system needs to show that the consumer authorized the purchase terms and confirmed the payment, even if the AI agent handled parts of the transaction.

All these reports show Visa is expanding payment passkeys across layers of digital commerce: issuer deployment in Asia Pacific, live online checkout in India, and agent-driven payments in Europe.

Article Topics

agentic commerce  |  biometric authentication  |  biometrics  |  digital payments  |  payment passkey  |  Thales Digital Identity and Security  |  Visa