A one-time passcode can be familiar and widely understood, but it can also interrupt a payment, depend on message delivery and expose customers to social-engineering risks. Device-based biometric-backed authentication offers a different experience, often relying on local user verification and cryptographic credentials.
The key issuer question is not which method sounds more modern. It is which available method is appropriate for the customer, transaction, device and regulatory setting.
Compare the experience the customer actually receives
An OTP challenge typically asks the cardholder to retrieve a code through a separate channel and enter it into the authentication flow. Delivery failures, device switching and phishing attempts can create friction.
Biometric-backed flows can use a device’s local user verification to unlock an authentication credential. The biometric itself generally stays within the device’s security boundary; the relying party receives an authentication result rather than a raw fingerprint or facial image.
That does not make every biometric flow automatically more secure. The security properties depend on the implementation, credential binding, device capabilities and protections against account takeover.
Understand Secure Payment Confirmation
Secure Payment Confirmation (SPC) is a standards-based approach that can enable streamlined payment authentication using supported browser and FIDO-related capabilities. It is not a universal alternative available on every device or in every transaction.
Issuers need to account for browser support, enrolment, credential availability and how the flow interacts with supported payment authentication standards. A well-designed strategy needs a fallback when the preferred method is not available.
GPayments has discussed SPC support in its issuer authentication technology. Organisations should verify the exact ActiveAccess release, configuration and scheme eligibility before planning a deployment.
Decide using security and usability criteria
A useful evaluation considers:
- Authentication strength: What factors and cryptographic protections does the method actually provide?
- Device and browser support: Can the customer complete the method in their real environment?
- Recovery: What happens if a device is lost or a credential becomes unavailable?
- Accessibility: Can users with different abilities and devices complete the journey?
- Fraud resistance: How is the process protected from phishing, account compromise and unauthorised enrolment?
- Evidence: What records establish how authentication was completed?
These dimensions are more informative than comparing completion speed alone.
A worked issuer scenario
Consider a customer attempting a higher-value purchase from a supported browser. The issuer has sufficient information to determine that step-up authentication is appropriate. The customer has an eligible, enrolled device credential.
The issuer may offer a supported biometric-backed verification experience. Another customer on an unsupported device might need an alternative authentication route. Neither pathway should be described as a downgrade by default: the institution must evaluate which approved method meets its requirements in each case.
Operational teams should test enrolment, recovery, device replacement and unsupported-browser scenarios as carefully as successful sign-in.
Where Decision AI might help
Decision AI could help issuers reason about the suitability of available authentication methods given the transaction context, supported capabilities and policy constraints. A system might identify that a method is unavailable or that an alternative approved route is required.
But a model recommendation cannot override protocol or regulatory rules. Nor should it invent biometric support for a device, or infer that a low-friction method is suitable solely because it tends to complete faster.
The right decision is one that can be explained using trustworthy signals and verified method capabilities.
Measure more than completion rate
Compare challenge success, abandonment, support cases, recovery events, suspicious enrolment and confirmed fraud where appropriate. Segment results by eligible versus ineligible devices so that performance claims are meaningful.
A faster flow that fails for a substantial part of the customer base may create more frustration than expected. A safer method that is poorly explained can also undermine confidence.
Design for choice under constraints
Issuer authentication is moving towards more flexible methods. The strategic goal should be a reliable set of supported paths, with clear rules for choosing among them – not a campaign to eliminate OTPs regardless of circumstances.
Frequently asked questions
Does biometric authentication send a fingerprint to the issuer?
In typical device-based credential flows, local biometrics unlock a credential on the device rather than being transmitted as raw biometric data.
Can SPC replace every 3DS challenge?
No. Support and eligibility depend on the browser, device, enrolment, protocol and applicable scheme requirements.
Take the next step
Discuss GPayments ActiveAccess authentication options, supported standards and deployment requirements with the GPayments team.