Mastercard identity check
What is Mastercard identity check?
Mastercard Identity Check is a protocol implementation designed for Mastercard payment cards. It adds an extra layer of security by verifying the identity during checkout, before the transaction is completed.
Mastercard Identity Check uses behavioral analytics and risk scoring to assess each transaction. In many cases the system determines that no further action is needed from the cardholder, and the payment goes through without interruption. When a transaction looks suspicious, the cardholder is asked to confirm their identity through their before the purchase can proceed.
Because it runs on the 3-D Secure 2.0 standard, Mastercard Identity Check exchanges far more transaction and device data with the issuer than the older protocol it replaced. That richer data lets issuers approve more low-risk payments without a challenge, so security improves while most customers see no extra step.
Key facts
- Also known as: EMV 3-D Secure for Mastercard; it replaced the older Mastercard SecureCode program.
- Applies to: Mastercard-branded credit and debit cards in card-not-present transactions, such as online and in-app purchases.
- Built on: the 3-D Secure 2.0 (EMV 3DS) authentication standard, the same framework behind Visa's equivalent program.
- Verification methods: , a one-time passcode, or approval inside the issuer's banking app.
- Supports: requirements where they apply, such as in the European Economic Area.
How it works
The protocol exchanges transaction data between the merchant, Mastercard, and the issuer to decide whether a given payment needs an identity challenge.
- Authentication request – When a cardholder submits a Mastercard payment, the merchant's gateway passes the transaction data to Mastercard Identity Check through the 3-D Secure 2.0 protocol.
- Risk assessment – The system analyzes transaction and device data to score how likely the payment is to be fraudulent.
- Frictionless flow – If the risk is low, the transaction is authenticated in the background and the cardholder finishes checkout with no extra steps.
- Step-up challenge – If the transaction looks risky, the cardholder verifies their identity with their issuer, using a biometric scan, a one-time passcode, or in-app approval.
- Authorization – Once the issuer confirms the cardholder's identity, it approves the transaction and the payment completes.
For merchant-initiated and recurring payments where the cardholder isn't actively present, authentication runs through the (3-D Secure Requestor Initiated) flow instead of a live challenge.
Why it matters
Mastercard Identity Check strengthens authentication on card-not-present payments, where the card and the cardholder can't be checked in person.
- A stolen card number alone isn't enough to complete a purchase, because defeating the check also requires the cardholder's device, banking app, or biometrics – credentials a rarely has.
- A successfully authenticated transaction triggers a , moving responsibility for fraud-related chargebacks from the merchant to the issuer.
- The frictionless flow authenticates most low-risk payments silently, so the added protection applies without sending every customer through an extra verification step.
Common issues
- Step-up friction: identity challenges add steps at checkout and can lead to cart abandonment when the issuer's verification flow is slow or confusing.
- Issuer inconsistency: the authentication experience depends on each issuer's implementation, so it varies from bank to bank.
- Enrollment gaps: not every card or issuer is fully enrolled, which limits authentication coverage on some transactions.
