Visa Payment Passkey

Visa Payment Passkey (VPP) enables issuers to securely offer enrollment and management of Visa Payment Passkeys directly through their own digital channels, enhancing security and user experience while eliminating the need for separate cardholder verification during registration.

It is a method for verifying payments by enabling device-based authentication across all participating merchants and Visa card-not-present acceptance solutions. Built on industry-leading FIDO (Fast Identity Online) protocols, it utilizes public key cryptography to enhance security. Unlike traditional passwords, Visa Payment Passkey employs unique keys for each PAN, making it highly resistant to phishing attacks, interception, and theft. The private key is securely stored on the cardholder’s device and never transmitted over the network, ensuring that malicious websites cannot access it. During verification, only the previously registered device enrolled in Visa Payment Passkey can be used, referencing the unique keys created during enrollment to provide an additional layer of security.

Issuers can allow cardholders to enroll and manage their passkeys conveniently within the issuer’s domain to maintain strong cardholder relationships. The cardholder’s login to the issuer domain (e.g., website or mobile banking app) will account for cardholder verification prior to passkey creation. At the time of enrollment, this verification is then authenticated when the passkey is subsequently used for device authentication, driving confidence in approval decisions.