xMoney lets customers create a Mastercard Payment Passkey inside its banking app, a first for an issuer
xMoney says it is the first Mastercard issuer to let customers create and enroll a Mastercard Payment Passkey directly inside its mobile banking app, satisfying Strong Customer Authentication while enabling Click to Pay checkout.
xMoney announced on June 11, 2026 that it is the first Mastercard issuer to offer in-app creation and enrollment of a Mastercard Payment Passkey, built directly into its mobile banking application rather than requiring enrollment through a separate wallet or merchant flow. The passkey authenticates online card transactions in a way that satisfies SCA (Strong Customer Authentication) requirements and unlocks Click to Pay checkout, Mastercard's tokenized one-click payment experience, at participating merchants. Because enrollment happens inside the issuer's own banking app rather than a third party's, the passkey is tied to an authentication relationship the customer already trusts and has already been verified through.
Why it matters
Payment authentication has largely been catching up to login authentication's move away from passwords and one-time codes, and issuer-hosted passkey enrollment closes a real gap: previously, getting a payment passkey onto a device meant trusting a wallet or merchant's enrollment flow, an extra party in a transaction that is supposed to be between the customer and their bank. Enrolling where the customer already has an authenticated relationship removes that extra hop.
It also strengthens the case that SCA compliance and phishing-resistant authentication aren't in tension: a properly implemented passkey satisfies the regulatory bar while being harder to phish than the SMS one-time codes SCA implementations have leaned on for years.
Source: FIDO Alliance
Related on Start with Identity
- BlogHID's Enterprise Attestation checks a passkey authenticator is company-issued before it can enroll
HID added a governance layer to its FIDO2 authenticators that checks for a certificate tying a device to a known company-issued authenticator before allowing pa
- BlogRSA brings passwordless authentication to Linux servers, closing its last password-only gap
RSA ID Plus now covers Linux servers, developer workstations, and critical infrastructure with FIDO-based passwordless sign-in, closing the gap where organizati
- BlogGoogle Workspace puts FIDO2 keys into the Windows login, days after Entra makes passkeys default
Google began rolling out FIDO2 security keys as a second factor at Windows sign-in for all Workspace customers on 13 July. Microsoft is making passkeys the defa
- PodcastEntra.Chat
A weekly show for Microsoft Entra administrators, with deployment stories from practitioners and the engineers who build the product. Hosted by a Microsoft empl
- PodcastOkta
Okta's 2023 interview series for product managers and marketers on using customer identity to build better experiences. One season, 14 episodes.
- ReportPhishing-Resistant MFA Support Matrix 2026
54% of 95 business SaaS apps support passkeys or security keys, but only 13% let admins require them, and 60% of apps with a documented SSO plan charge more for