Remote payment authentication is the process of checking that the person making a payment from a distance, such as online, in a mobile app or through a banking website, is the genuine holder of the card or account and has approved that particular payment. Because the payer and the card are not physically present, the issuer or bank must rely on things the customer knows, owns or is, rather than on a chip read at a terminal.
It is a specific application of payment authentication and is regulated most closely in the European Union and the United Kingdom, where strong customer authentication is mandatory for most remote electronic payments. For cards, the main protocol is 3-D Secure; for bank transfers, authentication usually happens inside the bank's own app or website.
Remote payment authentication in plain terms
When you pay in a shop, the cashier can see you hold the card and the chip proves the card is real. Over the internet nobody can see you, so anyone who has copied your card number could try to use it. Remote authentication is the extra step that closes that gap.
It works like a bank asking for two separate proofs before releasing money: perhaps a code sent to your phone and your fingerprint, or your password and a tap in your banking app. The bank also shows you the amount and the shop's name so you approve exactly that payment, not a blank cheque someone could change.
How it works
For an online card payment, the merchant or its payment provider collects data about the transaction and the device and sends it through 3-D Secure to the issuer. The issuer's systems, often using real-time fraud scoring, decide whether the payment can pass without interruption, in what is called a frictionless flow, or whether to challenge the customer. A challenge may use a one-time password, a confirmation in the banking app, or biometric authentication on a phone. The issuer then returns an authentication result that the merchant includes in its authorisation request.
Card wallets and network tokens can carry authentication done on the device, and some arrangements rely on delegated authentication, in which the issuer trusts a wallet or merchant to authenticate on its behalf. Passkeys built on FIDO Alliance standards are increasingly used as a phishing-resistant factor.
EU and UK rules
Under the second Payment Services Directive (PSD2), a payment provider must apply strong customer authentication when a payer accesses an account online, initiates an electronic payment or acts remotely in a way that may carry fraud risk. Authentication must combine at least two independent elements from knowledge, possession and inherence. For remote payments, the regulatory technical standards in Commission Delegated Regulation (EU) 2018/389 also require dynamic linking: the code generated must be tied to the amount and the payee. The rules applied from September 2019, with a later enforcement date for card e-commerce, and the UK kept equivalent rules after leaving the EU.
The standards allow exemptions, including low-value remote payments, low-risk payments under transaction risk analysis, payments to trusted payees, certain recurring payments and secure corporate processes. Merchant-initiated transactions, such as subscription charges made without the customer present, and mail and telephone orders fall outside the requirement.
Practice elsewhere
The United States has no general legal mandate for strong authentication on card payments. Issuers and merchants decide when to use 3-D Secure, guided by fraud rates and by the liability shift, under which an authenticated transaction moves liability for certain fraud chargebacks from the merchant to the issuer. US bank supervisors expect risk-based, layered multi-factor authentication for online banking. India's central bank has long required an additional factor of authentication for most domestic card-not-present payments, and several other markets have similar rules.
Weaknesses and trade-offs
Every added step can cause customers to abandon a purchase, so issuers and merchants try to keep challenges for risky cases. Some methods are weaker than they look: text-message codes can be intercepted through SIM swapping or handed over by a customer under social engineering, and authentication does not stop authorised push payment scams in which customers approve payments themselves. Strong methods also exclude people without smartphones unless alternatives are offered. As a result, supervisors and industry continue to move towards app-based, biometric and passkey methods, combined with risk scoring, rather than static passwords or knowledge-based authentication.