xMoney lets customers create a Mastercard Payment Passkey inside its banking app, a first for an issuer
xMoney says it is the first Mastercard issuer to let customers create and enroll a Mastercard Payment Passkey directly inside its mobile banking app, satisfying Strong Customer Authentication while enabling Click to Pay checkout.
xMoney announced on June 11, 2026 that it is the first Mastercard issuer to offer in-app creation and enrollment of a Mastercard Payment Passkey, built directly into its mobile banking application rather than requiring enrollment through a separate wallet or merchant flow. The passkey authenticates online card transactions in a way that satisfies SCA (Strong Customer Authentication) requirements and unlocks Click to Pay checkout, Mastercard's tokenized one-click payment experience, at participating merchants. Because enrollment happens inside the issuer's own banking app rather than a third party's, the passkey is tied to an authentication relationship the customer already trusts and has already been verified through.
Why it matters
Payment authentication has largely been catching up to login authentication's move away from passwords and one-time codes, and issuer-hosted passkey enrollment closes a real gap: previously, getting a payment passkey onto a device meant trusting a wallet or merchant's enrollment flow, an extra party in a transaction that is supposed to be between the customer and their bank. Enrolling where the customer already has an authenticated relationship removes that extra hop.
It also strengthens the case that SCA compliance and phishing-resistant authentication aren't in tension: a properly implemented passkey satisfies the regulatory bar while being harder to phish than the SMS one-time codes SCA implementations have leaned on for years.
Source: FIDO Alliance
Related on Start with Identity
- BlogHID's Enterprise Attestation checks a passkey authenticator is company-issued before it can enroll
HID added a governance layer to its FIDO2 authenticators that checks for a certificate tying a device to a known company-issued authenticator before allowing pa
- BlogRSA brings passwordless authentication to Linux servers, closing its last password-only gap
RSA ID Plus now covers Linux servers, developer workstations, and critical infrastructure with FIDO-based passwordless sign-in, closing the gap where organizati
- BlogGoogle Workspace puts FIDO2 keys into the Windows login, days after Entra makes passkeys default
Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the defa
- RecipeAdd login to a Next.js app with OIDC
A complete, copy-paste OpenID Connect login for the Next.js App Router using authorization code flow with PKCE, server-side token exchange, and httpOnly cookies
- GuideGreenfield CIAM: how to ship the first version in 8 weeks
A practical 8-week plan to ship the first version of a customer identity system for a new product: what to build, what to defer, build-versus-buy, and the pitfa
- GuideIdentity-first architecture: principles that hold up at scale
Seven principles for identity-first architecture that separate systems that scale from systems that get redesigned at every order of magnitude, plus a reference