For years, authentication has been built around a simple question: Is this really the customer?
That question is becoming harder to answer, and increasingly, it may not even be the right question.
Consumers now move between cards, digital wallets, real-time payments, stablecoins, and other digital payment experiences, each introducing new credentials and authentication methods. At the same time, artificial intelligence is beginning to act on consumers’ behalf, creating a future in which the person initiating a transaction may not be the person—or even the entity—actually making the decision.
Banks and credit unions have responded by deploying tools like payment credentials and tokens, passkeys, and trusted device verification. Each can strengthen security, but together, they can also create a fragmented authentication landscape.
The next challenge isn’t simply developing stronger ways to authenticate. It’s creating a trusted framework that can connect them all.
“While many banks have invested heavily to comply with regulations and strengthen authentication, challenges remain,” said Emmanuel Jamin, VP of Business Development, Digital Payment Solutions, at IDEMIA. “Fraud still targets critical journeys such as enrollment and account recovery.”
“Some issuers remain behind the curve, and others have delegated key trust decisions to device manufacturers or ecosystem providers such as schemes—losing visibility over who is being enrolled and trusted,” he said.
From Payment Card to Authentication Device
In the search for solutions, many leading banks have recognized that the foundation for stronger authentication may already be in place. This includes well-established capabilities such as customer credentialing, risk intelligence, and Know Your Customer (KYC) processes.
However, perhaps the strongest authentication asset institutions already have at their disposal is the EMV payment card.
These secure credit and debit cards contain microchips that generate a unique, one-time transaction code for every purchase. They are also KYC-backed, bank-issued, and cryptographically secure. Perhaps most importantly, EMV cards are already widely used and trusted by millions of customers.
As the digital payment landscape evolves, an expanding array of payment activities is making authentication more challenging. Across these scenarios, the payment card can provide something valuable—proof that a user possesses a verified credential.
“As high-risk journeys such as app enrollment and device binding, account recovery, and payment activation require stronger assurance, the payment card can act as an independent third factor alongside already deployed strong authentication solutions like mobile authenticator,” Jamin said.
“A simple tap proves possession of a trusted bank-issued credential, significantly increasing security while keeping the experience seamless,” he said. “With a FIDO applet embedded on the card chip, the payment card becomes more than a payment instrument. It becomes a powerful authentication device.”
Becoming a Prominent Participant
The overarching objective of these efforts is to build trust. Customers expect their financial institutions to safeguard their identity, money, and digital interactions. As authentication standards evolve and payment ecosystems become interconnected, banks must provide the consistency and convenience consumers expect across these experiences.
This has spurred many institutions to adopt scheme-led initiatives such as Click to Pay, which can simplify the payment experience and accelerate adoption. As a result, these solutions have become increasingly embedded in the checkout experience, making authentication an integral part of checkout rather than a separate security step.
Amid this transformation, however, many banks have found themselves relegated to a passive role. They should not be.
The evolution of checkout presents a significant opportunity for financial institutions to become more prominent participants in emerging commerce experiences.
For example, a financial institution can establish a more central role in the Click to Pay ecosystem by acting as a Digital Credential Facilitator (DCF)—a key layer between the issuer, card network, and digital wallet or checkout environment. This allows the bank to embed its own services and capabilities directly into the authentication journey.
Passkeys, Click to Pay, and DCF capabilities should strengthen the institution’s role as consumers’ most trusted resource—not dilute it. However, delivering these experiences will raise the bar for many issuers. They will need infrastructure capable of making accurate, near-real-time approval decisions without introducing friction for customers.
Still, the potential benefits of \this approach outweigh the challenges.
“Passkeys are a perfect example,” Jamin said. “While the industry is moving rapidly toward FIDO standards, banks should not be limited to consuming third-party authentication experiences. They should be able to leverage and encapsulate their own FIDO infrastructure, preserving ownership of customer trust while benefiting from ecosystem-wide interoperability.”
Authorizing the Agent
Active participation will become even more critical as agentic commerce emerges and fundamentally shifts the trust model for payments. When AI agents begin making purchases autonomously, an authentication model based primarily on static customer checks will no longer be sufficient.
Payment networks and issuers will need insight into which party authorized the agent, the parameters under which it was authorized, and how that consent can be proven in the event of a dispute. This is a change from the longstanding authentication model, which has focused primarily on verifying the customer.
In an agentic environment, authentication will require a framework that combines tokenized payment credentials, strong authentication methods such as passkeys, granular spending controls, and verifiable proof of consent.
More importantly, optimized authentication will likely require richer and more actionable data than is available today. This has been a longstanding pain point in e-commerce, where industry participants have worked to improve data sharing and transaction intelligence for more than two decades.
For example, the early iterations of what is now known as 3D Secure pioneered data sharing between merchants and issuers to improve the validation of e-commerce transactions. Yet there remains a pressing need for a modernized solution, one that can support complex digital interactions and new forms of commerce.
“Establishing trust in the agentic era will very much rely on bridging gaps across siloed data,” said Don Apgar, Director of Merchant Payments at Javelin Strategy & Research. “Commerce systems today capture more data at more points than ever before, but the industry hasn’t made much progress in advancing the sharing of that data and making it accessible at key decision points where it can make a difference.”
“Experience shows us that agentic fraud will grow as quickly as agentic commerce, and the best tool we have to stem that threat is by bringing the data we have into use at the point where it adds the most value in establishing trust,” he said.
Orchestrating the Framework
The growing complexity of the digital environment has made authentication more challenging, but the larger issue is orchestration.
As authentication methods proliferate, each new credential or verification mechanism can become another silo. Without a common trust framework to connect these capabilities, complexity can increase for consumers while making it more difficult for issuers to manage risk consistently across channels and use cases.
“Future commerce will rely on an increasingly diverse set of trust assets, including payment credentials and tokens, passkeys, digital wallets, trusted devices, consumer profiles, and even AI agents acting on behalf of consumers,” Jamin said.
“What is missing today is a unified trust layer capable of connecting identities, devices, credentials, and payment experiences into a single, consistent framework,” he said. “This layer must be able to bind the right credential to the right device, apply the appropriate level of assurance, and orchestrate trust seamlessly across every interaction.”
Building the Unified Trust Layer
Many of the building blocks for this unified trust ecosystem already exist within Click to Pay and Secure Remote Commerce (SRC) solutions.
“SRC brings together consumer profiles, recognized devices, payment credentials, network tokens, authentication methods, and issuer participation within a common framework,” Jamin said. “While it was initially designed to streamline checkout, it also illustrates how payment and trust assets can be orchestrated around a single consumer relationship.”
The opportunity for financial institutions is to extend this model beyond checkout and use it as a foundation for a broader trust ecosystem. This dynamic infrastructure could span disparate authentication methods, wallets, passkeys, device enrollment, and future commerce experiences.
Rather than adding more authentication points and increasing fragmentation, platforms like IDEMIA Secure Transactions (IST) can provide a unified trust framework—one that bolsters security, improves the customer experience, and gives financial institutions a foundation for future growth.
“Through our leadership in SRC, tokenization, and authentication, IST sits at the heart of the trust ecosystem,” Jamin said. “We see banks and payment networks increasingly looking to leverage their existing payment infrastructure to host and orchestrate passkeys, trusted devices, payment tokens, and customer credentials.”
“The goal is not simply to authenticate users, but to build a unified trust layer that connects and governs all trusted assets throughout the customer journey,” he said.
