Cardholder Authentication

Cardholder authentication is the set of checks used to confirm that the person making a card payment is the legitimate cardholder rather than someone who has stolen the card or its details. Depending on how the card is used, it may involve entering a PIN, signing a receipt, confirming with a fingerprint or face scan on a phone, typing a one-time code, or approving the payment in a banking app. The checks protect cardholders, merchants and issuers from fraud and decide, under card scheme rules, who bears the loss if fraud happens.

The term is related to, but separate from, card authentication, which checks that the card itself is genuine, for example by verifying the cryptogram produced by an EMV chip. Cardholder authentication answers a different question: whether the right person is using it. It also differs from authorisation, the issuer's decision to approve or decline a payment based on funds, limits and risk. In Europe and the UK, the legal standard for it is strong customer authentication.

At a shop terminal, the method is chosen by the card and terminal according to the cardholder verification method list on the chip. Common methods are:

• Online PIN. The PIN is encrypted and sent to the issuer for checking, standard at ATMs and for many debit cards.
• Offline PIN. The chip itself verifies the PIN without contacting the issuer, widely used in Europe.
• Signature. Once common in the United States, now largely optional because schemes dropped signature requirements for most merchants.
• Consumer device verification. When paying with a phone or watch, the cardholder is verified on the device by fingerprint, face recognition or passcode before tapping.
• No verification. Low-value contactless payments may skip checks up to a limit, with occasional PIN prompts to stop repeated misuse of a lost card.

Online and in-app payments are the main source of card fraud, because the card is not physically present. Here cardholder authentication is mostly delivered through 3-D Secure 2, in which the merchant sends transaction and device data to the issuer. The issuer either approves the cardholder silently, in frictionless authentication, or starts a challenge flow using a one-time password, a push notification to the banking app or biometric authentication. Other approaches include delegated authentication, where a trusted wallet or merchant performs the check on the issuer's behalf, and passkey authentication tied to the cardholder's device. The security code printed on the card is a weaker check, because it can be stolen along with the card number.

In most cases the card issuer authenticates its own cardholder, since it holds the PIN, phone number and app relationship, a role described as issuer authentication. Mobile wallets verify the user on the device and pass a result to the issuer, and digital checkout services such as Secure Remote Commerce can carry authentication data with the payment. Merchants also authenticate customers when they log into a shop account, but this does not count as cardholder authentication for scheme liability unless it is part of an approved programme.

Under the European payment services rules, most electronic card payments initiated by the payer must be authenticated with two independent factors from knowledge, possession and inherence, subject to exemptions for low-value, low-risk, recurring and merchant-initiated payments. Elsewhere, requirements come from local rules or card scheme policies; India, for example, has long required an additional authentication factor for domestic online card payments. Card schemes link authentication to liability. When a merchant successfully authenticates a card-not-present payment through 3-D Secure, fraud liability generally shifts to the issuer; for in-person payments, chip and PIN support affects which party is liable for counterfeit and lost or stolen card fraud.

Authentication adds steps that can cause customers to abandon purchases, so the industry tries to keep it invisible for low-risk payments. Methods also differ in strength: text message codes can be intercepted through SIM swaps or phishing, and determined fraudsters can trick cardholders into approving payments themselves. Device-based biometrics and passkeys are more resistant to phishing, which is why issuers and schemes are moving towards them. Strong authentication also does not help with disputes that are not about fraud, such as goods that never arrive.