Mastercard and Google Pay Bring Device Biometric Authentication to Card Payments

Mastercard and Google Pay announced a collaboration on September 16, 2026 to bring device biometric card payment experiences to Google Pay through eligible issuing banks.

How It Works

The solution leverages Mastercard's Consumer Device Cardholder Verification Method (CDCVM), letting cardholders authenticate online transactions using fingerprint or facial recognition capabilities already built into their smartphones — shifting verification to the device itself rather than a separate SMS-delivered one-time password.

Where This Applies

The feature is designed for everyday digital touchpoints, including utility bill payments, mobile recharges, and eligible online merchant checkouts — routine, frequent transaction types where reducing friction while maintaining security has the most cumulative impact on user experience.

Why Moving Away From SMS OTPs Matters

By shifting verification to the device itself, the approach removes a step in the online payment process that has traditionally relied on SMS delivery — a channel that can be affected by network delays or interception risks, including SIM-swap attacks that have become an increasingly common fraud vector against SMS-based authentication specifically.

An Optional Rollout, Bank by Bank

The feature is explicitly optional: cardholders and issuing banks retain the choice of whether to adopt biometric verification, with availability depending on participating banks and a rollout scheduled to complete by the end of 2026 — a gradual, opt-in approach rather than a forced platform-wide change.

What This Means for Digital Payments

A major card network and a major digital wallet jointly moving payment authentication toward device-native biometrics is a specific signal that SMS OTPs — despite being the default for over a decade — are increasingly viewed as the weaker link in payment security rather than the safe default, a trend merchants and fintech platforms should expect to see accelerate across other payment networks.