The Copper Race Is Coming Back to North America

The card number typed into a checkout form is one of the oldest attack surfaces in digital commerce. Mastercard has decided 2030 is the last year it survives.

Mastercard plans to phase out manual card entry and one-time or static passwords for e-commerce by 2030, using a combination of tokenization and on-device biometric authentication to enable secure checkouts. As of June 2026, that deadline is no longer a distant ambition. Mastercard says Europe is now almost halfway toward its goal of phasing out manual card entry online in the region and moving fully to biometrics and tokenization by 2030.

The mechanism is the Payment Passkey Service. It brings together tokenization, Click to Pay, and biometric authentication to create a seamless, one-click checkout experience across devices, eliminating the need for static or one-time passwords. The biometric itself never travels anywhere. Mastercard says neither the consumer’s payment credentials nor biometric data are shared with third parties. Instead, an encrypted cryptographic key stored on the user’s hardware does the work, and a fingerprint or face scan simply unlocks it locally.

The fraud problem this addresses is not minor. Claims that “roughly 80% of confirmed data breaches are related to weak or stolen passwords” are common in cybersecurity discussions, but this phrasing is not consistently supported as a breach-wide statistic, and Mastercard’s public materials around payment passkeys don’t frame it this way. What is well established is that one-time passwords are increasingly vulnerable to scams such as phishing and SIM swapping. Early adoption data suggests the passkey approach cuts meaningfully into those numbers: PayPal has reported that transactions authenticated with passkeys saw account takeover rates about 70% lower than password-based authentication, alongside a 10%+ improvement in login success rate.

The abandoned-cart angle is where the commercial logic sharpens. Cart abandonment averages 70.22% globally in 2026. Around 19% of shoppers abandon carts because they don’t trust a site with their credit card information. More than 36 million, or 67%, of UK shoppers abandoned online shopping at the checkout last year due to security concerns, lack of payment options, or forgotten card details. A checkout that replaces the card-entry form with a device-native fingerprint scan removes most of that friction in a single step.

The system allows shoppers to authenticate payments biometrically even in guest checkout scenarios, without needing an account with the merchant.

The Mastercard payment passkey service launched with pilots in markets including India, and Mastercard has positioned it as a capability banks, payment processors, and retailers can adopt as it scales tokenization, Click to Pay, and payment passkeys toward its 2030 goal. With Visa also offering a payment passkey service, 2026 is shaping up as a real acceleration phase for passkey-based authentication in payments.

The remaining friction is consumer skepticism. 41% of U.S. consumers would not trust an independent retailer or small chain with their biometric data, and 45% believe there will be a significant public backlash against biometric payments. Mastercard’s answer is that the data never reaches the retailer at all. Whether that explanation lands with a skeptical shopper reading a checkout page in two seconds is a different, harder problem. The technology is ready. The trust gap still needs closing.