Visa launches passkey authentication for card payments, replacing OTPs in India

Digital payments major Visa on Thursday launched Visa Payment Passkey in India, bringing biometric authentication to online card payments. The company expects the move to reduce dependence on one-time passwords (OTPs), combat phishing-led fraud and lay the foundation for AI-driven commerce..

The solution, which has gone live with IDFC FIRST Bank, enables Visa cardholders to authenticate online transactions using their device's fingerprint, facial recognition, PIN, password or pattern instead of SMS-based OTPs. It is initially available for select users shopping on platforms including Myntra, Paytm, MakeMyTrip, Tata Starbucks, Reliance Digital and EatSure, while fintech partners such as Juspay, Razorpay, PayU, Pine Labs, BillDesk, Wibmo, M2P Fintech and Paytm Payment Services will help scale adoption across merchants. 

Built on global FIDO authentication standards, the launch follows the Reserve Bank of India's September 2025 framework allowing alternative authentication mechanisms for digital payment transactions beyond SMS-based OTPs. 

The launch comes as nearly two-thirds of transactions on Visa's India network now originate from e-commerce, where authentication failures, phishing attacks and checkout friction remain among the biggest causes of payment drop-offs.

"OTP has served us well over the last 15 to 20 years, but we also know the amount of phishing, fraud and social engineering that has evolved around it," Ramakrishnan Gopalan,
 Head – Products, India and South Asia at Visa, told TechCircle. "We wanted to give consumers an alternative that is intuitive, contextual and far more secure."
Instead of waiting for an OTP, consumers authenticate payments using the same mechanism they use to unlock their smartphones.

"If I ask you to unlock your phone, you don't use an OTP. You use your biometric identity. Why should doing a payment transaction be any different?" Gopalan said.

Unlike passwords or OTPs, passkeys are cryptographic credentials securely stored on users' devices, making them resistant to phishing because they cannot be copied, intercepted or shared.

Visa believes India could emerge as one of the most advanced markets for passkey-enabled payments because card transactions are already protected through tokenisation.

"India is already 100% tokenised for e-commerce card transactions. No other major market has achieved that. Adding passkeys on top of tokenisation means we are actually leapfrogging several developed markets," Gopalan said.

Suresh Sethi, Group Country Manager, India and South Asia at Visa, said the launch represents the next stage in India's digital payments journey. "Trust is the foundation of India's digital payments journey. Combined with tokenisation, Visa Payment Passkey adds an important layer of protection, reduces friction and strengthens trust at every checkout," Sethi said.

"It also lays the foundation for the next era of agentic commerce, where trusted credentials and strong authentication will enable intelligent digital experiences to act safely on behalf of consumers." 

Visa expects the technology to improve payment success rates while reducing the number of authentication steps required to complete online transactions compared with traditional OTP-based authentication. Consumers need to register only once and can then use the same authentication experience across participating merchants and platforms. 

The company plans to make the service available across banks, payment gateways, payment aggregators and merchants rather than limiting it to select institutions.

"It will not be a particular merchant or a particular bank that offers Visa Payment Passkeys. Our objective is to make it available across the ecosystem at population scale," Gopalan said.

The launch also reflects a broader shift in how payment companies are responding to digital fraud. While earlier threats largely targeted payment systems, fraudsters today increasingly rely on phishing, fake customer-care calls and social engineering to trick users into revealing OTPs.
Visa says moving authentication to users' devices significantly reduces that risk. The company analyses billions of transactions across its global network every day, using AI-powered risk intelligence to help banks and merchants identify suspicious activity before transactions are authorised.

"We have a treasure trove of threat intelligence across markets. If a fraud pattern emerges anywhere globally, we are able to learn from it and help partners respond much faster," Gopalan said.

Beyond replacing OTPs, Visa sees passkeys as an important building block for the emerging era of agentic commerce, where AI assistants increasingly search, recommend and eventually purchase products on behalf of consumers.

"We're thinking beyond today's OTPs," Gopalan said. "As agentic commerce evolves, there will still be a human in the loop. Passkeys will become the mechanism through which consumers securely provide consent before an AI agent completes a transaction."

For Visa, whose long-term ambition is to accelerate India's shift towards digital payments, passkeys represent another step towards making payments secure, frictionless and largely invisible.

"Our North Star is simple," Gopalan said. "We want Visa to be the best way to pay and the best way to be paid while supporting India's journey towards greater digitisation of payments."