xMoney lets customers create a Mastercard Payment Passkey inside its banking app, a first for an issuer

xMoney announced on June 11, 2026 that it is the first Mastercard issuer to offer in-app creation and enrollment of a Mastercard Payment Passkey, built directly into its mobile banking application rather than requiring enrollment through a separate wallet or merchant flow. The passkey authenticates online card transactions in a way that satisfies SCA (Strong Customer Authentication) requirements and unlocks Click to Pay checkout, Mastercard's tokenized one-click payment experience, at participating merchants. Because enrollment happens inside the issuer's own banking app rather than a third party's, the passkey is tied to an authentication relationship the customer already trusts and has already been verified through.

Why it matters

Payment authentication has largely been catching up to login authentication's move away from passwords and one-time codes, and issuer-hosted passkey enrollment closes a real gap: previously, getting a payment passkey onto a device meant trusting a wallet or merchant's enrollment flow, an extra party in a transaction that is supposed to be between the customer and their bank. Enrolling where the customer already has an authenticated relationship removes that extra hop.

It also strengthens the case that SCA compliance and phishing-resistant authentication aren't in tension: a properly implemented passkey satisfies the regulatory bar while being harder to phish than the SMS one-time codes SCA implementations have leaned on for years.

Source: FIDO Alliance