Biometric Payment Authentication Statistics 2026: Passkeys and UPI

Passkeys have reached 5 billion in active use, according to the FIDO Alliance. The latest biometric payment authentication statistics show phone biometrics replacing PINs at checkout. The National Payments Corporation of India (NPCI) recorded over 611 million biometric UPI transactions in June 2026, with a total value of ₹25,416 crore.

Europe supplies the fraud side of the ledger, according to the EBA and ECB. Across the European Economic Area (EEA), only 40% of electronically initiated card payments were SCA authenticated in 2024 under strong customer authentication rules. Meanwhile, the annual fraud rate for remote card payments was 13 times higher in value than for non-remote card payments. The figures below combine passkey benchmarks from the FIDO Alliance, UIDAI’s Aadhaar face authentication series, NPCI’s biometric UPI counts, the EBA-ECB payment fraud report, and card network rollout data.

Key Takeaways

• FIDO Alliance Passkey Index participants report a 93% success rate for passkey logins, compared to 63% for other methods.
• UIDAI executed 28.29 crore Aadhaar face authentications in November 2025, against 12.04 crore a year earlier.
• Credit transfers were SCA-authenticated in around 71% of cases by volume, far above the 40% rate for card payments.
• Per the EBA and ECB, remote card payments accounted for around 83% of EEA card fraud in 2024 while making up only around 18% of card transaction volume.
• China and India both reached 88% passkey enablement, while France was at 64%, the lowest of the European markets shown.
• UK remote purchase card fraud losses reached £423.5 million in 2025, with case numbers at 3.2 million, per UK Finance.

Editor’s Choice

• Passkeys in active use: 5 billion worldwide.
• Biometric UPI transactions: over 611 million in June 2026.
• EEA payment fraud: €4.2 billion in 2024, up from €3.5 billion in 2023.
• Aadhaar face authentications: more than 500 crore since the 2021 launch.
• Passkey sign-in time: 8.5 seconds per sign-in, against 31.2 seconds with traditional MFA.
• UK unauthorised fraud prevented: £1.68 billion in 2025.

Biometric Payment Authentication Statistics at a Glance

• 90% of consumers are familiar with passkeys, and 75% have enabled them on at least some accounts.
• One-third of consumers experienced an account compromise or breach notification in the past year, and nearly half will abandon a sign-in or purchase when they cannot remember a password.
• UIDAI’s face authentication technology has been adopted by nearly 200 entities, including banks, non-banking financial companies and brokerage firms.
• Around 17.06 million fraudulent card transactions were executed in 2024 out of around 111.05 billion transactions on cards issued in the EU/EEA.
• The annual fraud rate for card volumes was 0.015% of all card payments in 2024, practically the same as 2023.

Source: FIDO Alliance 2026, NPCI 2026, UIDAI 2026, EBA and ECB 2025

About This Data

Compiled from 22 sources. Of these, 14 are primary sources, 3 are industry research, and 5 are secondary reports, published between May 2024 and September 2026. Only regulator, central bank, industry body, and first-party company data qualified, and market-research sellers were excluded. Figures are updated when sources publish new editions.

Don't chase the news. Let us curate it.

You get one weekly briefing with only the stories that matter. If the market is quiet, we skip it.

Email address

Get the Weekly Briefing - it's free!

Read by pros at Visa, Mastercard, Vanguard, and the FDIC.

Passkey Adoption by Country and Region

• Globally, 75% of consumers have enabled passkeys on at least some accounts, with APAC at 77%, the US at 74% and Europe at 70%.
• APAC leads on adoption, driven by very high rates in China and India.
• Within Europe, the UK (77% with passkeys enabled on at least some accounts) is ahead of Germany at 70% and France at 64%.
• The consumer survey covered 11,000 adults who regularly log in.

Recent Developments

• September 2026: In-Solutions Global and Visa launched Visa Payment Passkey at Global Fintech Fest 2026, with Union Bank of India, Central Bank of India, Bank of Maharashtra, Indian Overseas Bank and Indian Bank as participating issuers.
• September 2026: On September 9, UIDAI launched its Aadhaar Face Authentication SDK and Sandbox, after processing more than 500 crore face authentication transactions.
• July 2026: NPCI reported over 600 million biometric-based UPI transactions in June.
• June 2026 (scheduled end date): Amazon said it would discontinue Amazon One services at retail businesses on June 3, 2026, citing limited customer adoption.
• May 2026: The FIDO Alliance reported that 68% of organizations are deploying, piloting, or rolling out passkeys for employee authentication.

Passkey Sign-in Performance vs Passwords and OTPs

• The Passkey Index draws on nine FIDO Alliance members, including Amazon, Google, Microsoft, PayPal, and Target, that have deployed passkeys for 1 to 3 years.
• Passkeys have a 30% higher sign-in success rate compared to traditional MFA methods.
• Participants reported a 73% decrease in login time when using passkeys.
• The comparison group of other authentication methods includes social login, MFA, and OTPs.

Source: FIDO Alliance and Liminal, Passkey Index October 2025

Consumer Passkey Habits by Region

• Globally, 49% of consumers use passkeys whenever possible or most of the time.
• Habitual use in APAC runs 5 percentage points above Europe.

Business Outcomes of Passkey Deployment

• 57% of organizations that have deployed passkeys still rely on phishable authentication methods for primary day-to-day sign-in.
• 89% of organizations report confidence in their ability to restore access when passkeys are lost.
• For many organizations, deploying passkeys has not yet meant retiring passwords.

Biometric UPI Payment Statistics in India

• NPCI’s on-device biometric authentication supports both person-to-person and person-to-merchant transactions, and is also available for RuPay Credit Card on UPI.
• UPI carried 2,264.11 crore transactions worth approximately ₹29.53 lakh crore in March 2026.
• 691 banks are live on UPI, which accounts for nearly 81% of total retail payment volume in India.
• NPCI BHIM Services Limited (NBSL) introduced biometric authentication for UPI payments on the BHIM Payments App on March 24, 2026.

Source: NPCI 2026, NBSL 2026, PIB 2026

Can you pay with UPI using a fingerprint instead of a PIN?

Yes. NPCI’s on-device biometric authentication allows users to authorise payments using a smartphone’s fingerprint or facial recognition. On the BHIM app, users can approve transactions of up to ₹5,000 this way, and transactions above ₹5,000 still require the UPI PIN, an extra layer of protection for higher-value payments.

Aadhaar Face Authentication Transactions by Month

• On September 1, 2025, UIDAI observed its highest ever single-day count of face authentication transactions, over 1.5 crore, beating the previous high of over 1.28 crore on 1 August 2025.
• Nearly 60% of the Digital Life Certificates generated by pensioners during November 2025 used Aadhaar face authentication.
• Aadhaar number holders executed over 221 crore authentication transactions of all types in August 2025.
• More than 150 entities, including financial institutions and telecom service providers, were using face authentication by September 2025.

Source: UIDAI via Press Information Bureau, 2025

By the numbers: UIDAI executed 28.29 crore face authentications in November 2025, as against 12.04 crore in the same month of 2024, about 2.35 times the prior-year volume. The cumulative count doubled from 100 crore in January 2025 to the 200 crore milestone on 10 August 2025.

Face checks now sit beside the onboarding flows in our eKYC adoption statistics.

EEA Payment Fraud Totals Under Strong Customer Authentication

• Credit transfer fraud losses reached €2.200 billion in 2024, a year-on-year increase of 16%.
• Card payment fraud on cards issued in the EU/EEA reached €1.329 billion in 2024, a year-on-year increase of 29%.
• Transactions verified with SCA were generally less susceptible to fraud than those without it, especially card payments.
• For credit transfers, payment service users bore approximately 85% of total fraud losses in 2024, mainly as a result of scams that tricked users.

Total fraud rose even though the fraud rate stayed stable at around 0.002% of total transaction value in 2024, according to the EBA-ECB 2025 Report on Payment Fraud. Rising totals on a flat rate point to volume growth, a pattern also visible in our digital payment fraud statistics.

SCA Coverage and Card Fraud Rates by Channel

• The low SCA share for card payments is mostly explained by point-of-sale use, where exemptions like the ones for contactless payments and transport fares are more prevalent.
• The 2024 fraud rate was 13 times higher in value and 22 times higher in volume for remote card payments than for non-remote card payments.
• Card payment fraud was 17 times higher when the payment recipient was outside the EEA, where SCA is not legally required and often not used.

Source: EBA and ECB, 2025 Report on Payment Fraud

Why it matters: Remote card payment fraud accounted for around 83% of all card fraud in 2024, while remote payments were only around 28% of card transaction value, per the EBA and ECB. Payment passkeys target remote checkout, the largest slice of card losses.

Our contactless payment statistics show how common those exempt taps have become.

Does strong customer authentication reduce card fraud?

Yes, for card payments. The EBA and ECB found that transactions verified with SCA were generally less susceptible to fraud than those without it, especially card payments, while for other payment types, such as credit transfers, this effect was less clear. Card payment fraud was 17 times higher when the payment recipient was outside the EEA, where SCA is not legally required.

UK Card Fraud and OTP Compromise Statistics

• Criminals continued to deploy social engineering tactics in 2025, including compromising one-time passcodes to register digital wallets or make fraudulent transactions.
• UK unauthorised fraud losses totaled £703.4 million across 3.81 million reported cases in 2025.
• Authorised push payment fraud losses rose to £576.4 million, with 248,070 cases recorded.
• Remote banking fraud cases reached 37,646.

A texted code can be talked out of a victim, and a device biometric helps reduce that risk. The same pattern runs through our credit card fraud statistics.

Card Network Payment Passkey Rollouts

• More than a third of Mastercard transactions worldwide are already tokenized.
• Where tokenization is live, approval rates have risen by up to 6%, generating more than $2 billion in additional sales each month for merchants.
• Mastercard‘s next phase targets full adoption in Singapore, Malaysia and Vietnam by 2027.
• Card-not-present fraud remains seven times higher than in-store, according to Mastercard, and Visa put online payment fraud at seven times higher than in-person payments in its 2024 passkey announcement.
• Visa’s tap to pay penetration reached 65% globally at the end of 2023, a figure now more than 12 months old.

Mastercard cited Reserve Bank of India data showing fraud cases in India surged by nearly 300% in the two years before its passkey launch. Tokens hide the card number, and the biometric verifies the person; the pairing is tracked in our payment tokenization statistics.

Palm and Face Biometrics at the Point of Sale

• 7-Eleven launched Tencent palm payment in 1,500 stores in a month, boosting cashier efficiency by 25% during peak times.
• Tencent’s palm payment user base grew from 100,000 to 10 million in 3 months.
• Amazon One launched in 2020 to speed up in-store entry and payments, and Amazon rolled it out to more than 500 U.S. Whole Foods stores in 2023.
• Amazon said all customer data associated with Amazon One will be securely deleted after the service ends.

Source: Tencent PalmAI, company timeline to March 2024

Worth noting: Amazon said it would discontinue Amazon One at retail businesses on June 3, 2026, with a spokesperson citing limited customer adoption of its authentication service for facility access and payment. Dedicated palm readers need store hardware, while phone biometrics ride on devices shoppers already carry.

Tencent’s figures are company-reported and date to its first year inside the ecosystem covered in our WeChat statistics.

Biometric Authentication Rules and Deadlines

• Under the Reserve Bank of India (Authentication mechanisms for digital payment transactions) Directions, 2025, factors of authentication may comprise fingerprint or any other form of biometrics, device native or Aadhaar-based.
• The directions apply to all domestic digital payment transactions, unless specifically exempted.
• If any loss arises from transactions effected without complying with the directions, the issuer must compensate the customer in full.
• The EBA and ECB found that SCA remains effective against the fraud types it was designed to mitigate and that were dominant when PSD2 came into force.

Source: Reserve Bank of India 2025, Mastercard 2025

Conclusion

Passkeys now number 5 billion in active use, and India’s UPI rail logged over 611 million biometric transactions in a single month. At payment scale, biometric authentication is a phone feature paired with tokens and identity rails.

Card issuers in India must also put in place a mechanism to validate non-recurring, cross-border card-not-present transactions. The RBI’s October 2026 deadline for that mechanism and the next EBA-ECB fraud edition will show whether payment passkeys become default checkout behavior.