Every issuer has systems in place to verify cardholders. But in a world where authentication is critical to every transaction, it is often treated as an afterthought once those systems are in place.
That disconnect is becoming increasingly costly. As consumers shift to e-commerce, mobile, and card-not-present transactions, conventional authorization methods are struggling to keep pace. The result? Greater fraud exposure on one side—and false declines, abandoned carts, and lost revenue on the other.
So, what if authentication didn’t have to be a point of friction, but an advantage?
To explore the growing disconnect between how consumers pay and how they’re authenticated, PaymentsJournal sat down with Adam Lowe, Chief Technology Officer at CompoSecure and Founder of Arculus. His answer: embed hardware-bound authentication directly into the payment card itself. By making authentication part of the card—not an additional step—issuers can address today’s pain points while turning authentication from a friction producer into a driver of growth.
What factors have emerged that are challenging the traditional view of authentication, which largely revolved around passwords?
Passwords have been passé for a while now, and the main reason they’re just not effective anymore is the velocity of attack. It used to be you had to be reasonably sophisticated to launch an attack on someone’s password set but you don’t anymore, given the advent of AI and other things.
It almost sounds trite to say AI, but it’s true in the case where anyone that can Google something now can launch a reasonable attack. That’s part of what makes this challenging, that and the fact that a password is a shared secret and a phishable credential. We all remember middle school and how long secrets stay secret.
It’s further compounded by the reset mechanism for passwords, which is often terrible. Let’s say you forget it and the reset mechanism is email. It’s often trivial to hack someone’s email. Then, I just fake I’m you, fake that I forgot it, reset it, and now I’m in your account.
Things like that are one of many reasons why passwords just are not in any way sufficient to keep accounts safe.
How is authentication evolving in the era of e-commerce, mobile transactions, and card-not-present?
There are a number of layers of problems within accounts and card-not-present. I’m logging into my favorite e-commerce platform to buy something, so I need to keep that platform safe.
That’s why many of those e-commerce platforms have gone to passkeys. For example, Amazon has said they’re going to be password-less by 2030. Going to passkeys is a great step in the right direction. It’s a non-phishable credential. A passkey is essentially a digital key that signs a challenge and proves you’re you.
Many times, they live in the phone or are synced in the cloud. That’s much better than a password, but still problematic. I used to work for defense, so I’ve seen phones rootkitted, I’ve seen clouds hacked, I’ve seen Samsung keyrings and Apple keyrings breached.
I want my keys in my pocket, the same way I have a key to my front door in my pocket. I want the digital key to my digital life also in my pocket.
As organizations search for better authentication solutions, why is an embedded, hardware-bound card solution best suited to improving authorization rates?
We were the first to put hardware-bound passkeys on payment cards, because it’s such a force multiplier.
Imagine I’m on a journey in my favorite e-commerce store. I could use that card to securely log me in if the platform sees anything weird, like you’re on a weird IP or you’re in a weird place. You log in, now you’re in your e-commerce securely.
On top of that, sometimes you would have card-not-present. Say we’re in another user journey and you’re in your favorite e-commerce. Obviously, you’re not physically there so they have to decide you’re you. I can tap my card and whether it’s through 3D Secure 3DS2 rails to prove I am me via the merchant, or whether the issuer simply wants to de-risk the transaction, they could ask me to tap the card.
Not only am I proving I am me with a passkey, I am proving I am me and I have possession of the card. It’s effectively proving a card-present transaction—even when the card is not present—cryptographically.
You have this synergy of possession and identity, which is why we think putting passkeys on a payment device is unique and brings a lot of value.
Amid all the focus on fraud, false declines are often a more impactful financial drain. What are the holistic impacts of wrongly declined transactions?
When we talk to banks and FIs about the solution, everybody immediately thinks about fraud. And fraud is huge, keeping accounts safe is huge, and it’s the first place everyone goes very reasonably.
But the second thing that I say when we’re talking to FIs is this is not just a cost savings, this is not just fraud savings, this is a revenue driver because you’re going to pick up whole points of false decline. We see in many FIs that false declines can be over an order of magnitude greater than their fraud cost, where it could be 20x their fraud costs in some cases.
Here, they were going to decline a transaction anyway, so let’s say you ask for a step-up transaction, just a little bit of friction. You have the customer tap the card. You’ve gotten all that revenue back, all that interchange back, and you’ve completed a customer journey instead of declining them, which could possibly then move your card to back of wallet, and it’s hard to become top of wallet again.
False decline is real, and we have a meaningful way to fix it, and we could drive substantively more revenue for banks and fintechs and other FIs.
Beyond better fraud prevention and reducing false declines, what are the revenue, performance, and loyalty benefits that are derived from adopting this approach to authentication?
I always think about completing journeys and completing carts, because we’re all busy and we’re all trying to do something. I’m trying to buy a bottle of water in Las Vegas, or I’m trying to buy a thing online, and people have low patience now because of the speed of life.
If you inconvenience someone, it’s going to have a large impact, and you’re going to have a tough time gaining that loyalty back. It’s so expensive to acquire consumers, you don’t want to lose them once you’ve acquired them. When you think about this passkey system, it is a holistic way to bring more value to your customer.
You’re keeping them safe from fraud, you’re giving them a password-less way to log into something. They don’t have to remember a 16-character password that changes every 90 days. You’re giving them a way to make their transactions go through.
Then, you can also drive engagement. While many of our more traditional banks focus on things like fraud and completed carts, some of our fintech customers use it to drive engagement and loyalty—tap to win tickets to your favorite concert, opt into a sweepstakes, or show that you are in a given store for a given opportunity.
There’s a lot of interesting places where identity and possession and payments all start to dovetail together.
How is Arculus Authenticate positioned to address this need?
The first thing is we’re not asking customers to learn something new. People are busy and training consumers is challenging. Visa and Mastercard have taught customers to tap all over the world. If you look at card-present transactions, the vast majority of them are NFC-enabled tap to pay now.
In the same way that you can tap to pay, we’re asking you to tap to be secure. We’re not asking users to do anything new. Most people carry 1-N cards, and we’re not asking you to carry something else. You already have the thing and you know how to use it, so from a consumer behavior standpoint, we’re well-positioned.
The other thing we address is root of trust. It’s a centrally-issued credential with robust cryptography, and it’s air gapped—it’s not hot to the cloud coming up and down. The keys are offline in your pocket in a passive device. From a security standpoint, it’s best in class.
You have this secure element in your pocket that securely generates, stores, and manages keys, and you have an easy user experience that people are used to. That combination bodes well. It’s not another app to download on your phone; it’s not another widget to carry; it’s not a completely new experience. It’s tap to prove you’re you, and users get that.
Any final thoughts?
What I hope our banking and FI partners take away is that this is a win for the top line and a win for the bottom line. You’re going to see usage frequency go up. You’re going to see better authorization for transactions. You’re going to see better loyalty and retention. You’re going to see better top-of-wallet behavior.
You’re going to see all the metrics on the top line that you want to see, and you’re going to see those bottom-line metrics too. You’re going to see reduced password reset cost, reduced fraud cost, reduced false decline costs, and reduced servicing costs.
The top line and the bottom line for the business owners of these products, it is just demonstrably obvious once you start seeing it.