Home / Wiki / I / Issuer Authentication

Issuer Authentication

Cards and IssuanceUpdated 15 Nov 2026

Issuer authentication is the process by which a card issuer confirms that the person making a payment is the genuine cardholder, and it is explained in full under cardholder authentication. The two terms describe the same step from different angles: "cardholder authentication" names who is being checked, while "issuer authentication" names who does the checking.

The phrase is most common in online card payments. Under 3-D Secure 2, the issuer's access control server receives data about the purchase and either approves it without friction or asks the cardholder to confirm, for example with a banking app or one-time passcode. Because the issuer performed the check, fraud liability for an authenticated transaction generally moves from the merchant to the issuer under card scheme rules. In Europe the same step is how issuers meet strong customer authentication requirements.

In chip payments, "issuer authentication" also has a narrower technical meaning: the card verifies a cryptogram sent back by the issuer in the authorisation response, which proves to the chip that the reply really came from its issuer. That meaning is part of the EMV chip specifications.

Last updated 15 Nov 2026