Mastercard and Google Pay have previewed a biometric authentication feature intended to replace SMS one-time passwords for online card payments.
Once available, eligible Mastercard cardholders who have securely saved their card details on Google Pay will be able to authenticate online payments using fingerprint or facial recognition on their device, instead of entering a one-time password sent by SMS. The feature is intended to apply to transactions such as bill payments, mobile recharges, and online shopping.
CDCVM technology underpins the feature
The authentication method relies on Mastercard's Consumer Device Cardholder Verification Method (CDCVM), a technology that verifies a cardholder's identity through biometric or passcode checks performed directly on their device. By shifting verification to the device itself, the approach removes a step in the online payment process that has traditionally relied on SMS delivery, a channel that can be affected by network delays or interception risks.
According to Mastercard and Google Pay, the availability of the feature will depend on participating banks, and its rollout is scheduled to be completed by the end of 2026. The feature will also depend on device compatibility, and its use will be limited to transaction types supported within the Google Pay application.
The companies have described the feature as optional, meaning cardholders and issuing banks retain the choice of whether to adopt biometric verification.
Replacing SMS OTPs gains more attention as friction rises
The preview comes as SMS OTPs face a number of structural challenges that are prompting businesses to look at alternatives. According to an EngageLab article on SMS OTP Alternatives, SMS pumping fraud, which uses automated OTP requests to generate revenue through premium-rate numbers, has driven global telecom fraud losses estimated at USD 41.82 billion.
The channel also remains exposed to SIM swap and SS7-based interception, while added steps such as switching apps and entering a code before expiry increase friction and reduce conversion.
Following EngageLab’s data, as a result, organisations are turning to complementary methods in order to overcome the challenges raised by the SMS identification option. These include silent, carrier-based authentication requiring no user action, passkeys, which use device biometrics and phishing-resistant public-key cryptography, push authentication requiring a single tap, and authenticator apps generating codes locally without network dependency.
Recently, in 2026, Visa extended a collaboration with Handware to offer support within its biometric payment platform, which uses palm-based recognition for digital transactions.
