Passwordless payments: Mastercard and Thales on the future of secure digital payments

Thales and Mastercard recently came together to discuss the future of digital payments. As long-standing partners in the Mastercard Engage programme since 2017, collaboration has extended across tokenization, digital issuance and innovation in digital payments.  

In this conversation, Mark Colston, Vice President Global Issuer Digital Enablement at Mastercard, Yelda Akdere, Vice President Fintech Solutions, Mastercard Engage at Mastercard and François Chaffard, Vice President, Digital Payment Services, Thales, discuss the evolving challenges of online checkout, Mastercard’s bold 2030 vision, and how issuers can accelerate adoption of technologies such as Click to Pay and payment passkey.  

From infrastructure readiness and data quality to tokenization and payment passkey, the discussion highlights how strong partnerships are critical to delivering secure, seamless and passwordless experiences. 

Here are the key insights from the conversation, and what they mean for issuers navigating the next era of digital payments. 

The challenges facing online checkout today

While in-store payments have become effortless, online checkout still lags behind. 

Mark Colston outlined four persistent friction points: higher fraud rates online, lower approval rates, cart abandonment caused by manual card entry, and ongoing consumer discomfort around saving card details. 

With roughly a quarter of carts still abandoned due to friction, the opportunity to improve conversion and trust is significant. 

The pace of innovation, and the pressure on issuers

Francois Chaffard reflected on how significantly the pace of change has accelerated. Moving from contact to contactless once took nearly a decade. Today, new payment paradigms emerge in just a few years. 

Issuers no longer have the luxury of gradual transformation. Instead, they face growing pressure to modernise their infrastructure while managing competing priorities. 

One of the most underestimated challenges? Data. 

As payments evolve from simple card credentials to token-based, identity-driven models, issuers must manage increasingly complex datasets – including tokens, email addresses, shipping details and soon biometric credentials – all synchronised in real time. 

Clean, accurate, accessible data is becoming foundational to digital payments. Without it, card issuers face an uphill battle in their abilities to combat fraud and improve their rates of card approval, as well as in maintaining a secure and convenient cardholder experience. 

Mastercard’s 2030 vision: tokenisation, Click to Pay and payment passkey

Mastercard’s 2030 ambition centres on eliminating manual card entry and passwords altogether. 

The strategy rests on three pillars: 

• Network tokenisation, replacing sensitive card details with secure tokens
• Click to Pay, enabling seamless guest checkout without manual entry
• Mastercard Payment Passkeys, introducing biometric authentication in place of passwords 

Together, these technologies aim to deliver what consumers already expect: fast, secure and consistent checkout experiences across devices and channels. 

Making Click to Pay scalable for issuers

Behind the simplicity of Click to Pay lies significant operational complexity. 

François Chaffard described the “invisible part of the iceberg”: before issuers can mass-enrol cards, they must ensure customer data is accurate and complete. In practice, many banks discover inconsistencies, be that incorrect email formats, incomplete phone numbers or outdated records. 

To address this, Thales has focused on simplifying integration. Through a single connection to the Thales D1 platform, issuers can enable tokenisation, Click to Pay and lifecycle management without extensive local development. 

When implemented at scale, adoption can be rapid. In one example shared during the session, a bank enrolled one million users into Click to Pay in a single day. 

The key is making Click to Pay a seamless, card-level feature – not an optional add-on. 

How biometrics will transform online checkout

If tokenization removes exposed credentials, biometrics remove passwords. 

Mastercard Payment Passkeys allow consumers to authenticate using on-device biometrics, creating a checkout journey that is both more secure and more intuitive. 

The shift also presents an opportunity for banks to modernise authentication more broadly. While biometric authentication is already common in mobile banking apps, payment authentication has traditionally followed a separate path. 

Now, tokenisation and payment passkey create the possibility of convergence – using the same secure biometric foundation across both banking and payments. 

The result? Greater consistency, stronger security and reduced friction. 

From vision to execution

The discussion reinforced a central theme: innovation alone is not enough. 

Delivering passwordless transactions requires issuers to modernise infrastructure, clean and synchronise data, and adopt scalable platforms that simplify complexity. It also requires strong ecosystem partnerships. 

As Mastercard sets its 2030 vision in motion, collaboration with technology partners like Thales will be critical in turning ambition into implementation and making seamless digital payments the new global standard.