Biometric authentication

What is biometric authentication?

Biometric authentication is a verification method that confirms identity by matching a physiological or behavioral trait, such as a fingerprint, face, iris, or voice, against a template captured when the person enrolled. It's the inherence factor in authentication: something the cardholder is, rather than something they have or something they know.

In payments, the check almost always runs on the cardholder's own device rather than on a merchant or

issuer

server. The phone or laptop compares the fresh scan against the stored template locally and passes on a signed result. The raw trait never leaves the hardware, so what reaches the payment flow is a pass or fail signal, not an image of anyone's face.

Key facts

Factor type: inherence, one of the three authentication factors alongside ownership (a card, a phone) and knowledge (a
personal identification number
, a password)
Traits used in payments: fingerprint, facial geometry, iris pattern, voice, and behavioral signals such as typing cadence
Where matching happens: in a secure area of the device processor, isolated from the operating system and apps
Regulatory role: satisfies one of the two factors required under
strong customer authentication
for in-scope transactions in the EEA
Not the same as a biometric payment:
biometric payment
names the transaction; biometric authentication is the identity check inside it

How biometric authentication works

Enrollment. The cardholder registers the trait once on the device. The scan is converted into a mathematical template and stored in hardware under
encryption
. The original image is discarded.
Capture. At checkout, the sensor takes a fresh reading of the same trait.
Matching. The device scores the new reading against the stored template and accepts it when the score clears a preset threshold. Matching is probabilistic, not an exact comparison.
Assertion. On a match, the device unlocks a private key in the secure hardware and signs a response for the wallet or app that requested it. In a
digital wallet
, the same unlock releases the payment token standing in for the card number through
tokenization
.
Authorization. The signed result travels with the authentication message to the issuer, which factors it into the approve or decline decision. Under
3DS
, a biometric prompt is the most common way a
challenge flow
is resolved on mobile.

Why it matters

A
card security code
or PIN can be phished and replayed by whoever obtains it. A fingerprint template sealed in device hardware can't be typed into a form, so credential theft alone doesn't produce a usable authentication.
A biometric prompt resolves in a single gesture, removing the password-recall and one-time-code steps where cardholders abandon a 3DS challenge.
Completing an authenticated 3DS transaction moves fraud chargeback liability from the merchant to the issuer, and the biometric prompt is what clears the authentication step on mobile. See
liability shift
.

Common issues

False rejects. Wet fingers, gloves, masks, and poor lighting cause failed reads. The device then falls back to a passcode, which reinstates the weaker knowledge factor for that attempt.
Device binding, not identity binding. The check proves the enrolled device owner is present, not that they're the legitimate cardholder. Wallet providers run separate identity verification when a card is first provisioned.
Re-enrollment on device change. A new phone means new templates and re-provisioned tokens. Cardholders who skip that step fall back to manual card entry.
Data protection scope. Biometric data is a special category of personal data under the GDPR in the EEA. On-device matching keeps merchants and processors out of scope: they never receive the trait itself.