Delegated authentication in payments: Everything to know

Key takeaways

• Learn how delegated authentication moves SCA into the merchant or PSP checkout experience.
• Understand how biometrics, passkeys, FIDO and 3D Secure work together to authenticate payments.
• Explore merchant use cases, benefits and the technical requirements for implementing delegated authentication.

If you’ve ever paid for something on an app or website using your fingerprint, you’ve likely experienced delegated authentication. This process allows merchants or payment service providers to control customer verification instead of the card issuer, which comes with a range of benefits for both the business and the user.

This article covers everything you need to know about delegated authentication in payments, including how it works, use cases, benefits, and how to integrate it as a merchant. 
 

Delegated authentication and PSD2 SCA exemptions

Under PSD2, almost all card-not-present (CNP) transactions in the EU and UK require SCA, which can be satisfied using delegated authentication without a full 3D Secure (3DS) challenge. However, PSD2 also allows for SCA exceptions like:

• Transaction risk analysis (TRA) – This allows PSPs to skip SCA on low-risk transactions if their fraud rate stays under set thresholds.
• Low value exception – Transactions under €30 don’t need SCA.
• Trusted beneficiaries – Customers can whitelist merchants with their issuer to bypass SCA.

Exemptions ask the issuer to skip SCA entirely, while delegated authentication moves the SCA to the merchant or PSP. The issuer is still involved, but it’s relying on the merchant’s verification rather than running its own check. 

Delegated authentication vs 3D Secure

With traditional 3DS, customers get bounced to the issuer’s flow to complete a transaction or need to wait for a text with a one-time password (OTP) from the bank. But under delegated authentication, a single sign-on (SSO) appears on the login page, allowing customers to check out with a quick biometric verification.

Swapping out an issuer’s 3DS challenge for merchant-designed delegated authentication leads to reduced checkout friction, higher conversion rates, and an overall better customer experience without sacrificing payment security. 

How does delegated authentication work?

Here’s a breakdown of how delegated authentication works, both for initial enrolment and future purchases. 

Enrolling in delegated authentication 

When a customer enrols in delegated authentication for the first time, this is how the process works:

1. The customer signs onto a merchant app or website, usually through SSO or an existing account.
2. The customer heads to checkout, and the merchant prompts them to enrol in biometric payments.
3. The customer opts in and scans their face, fingerprint, or sets up a passkey (which is becoming more and more common). This binds the customer’s credentials to the specific device using FIDO standards.
4. The merchant or PSP registers the device-bound credential with the card scheme.
5. The first transaction is completed, sometimes requiring a 3DS challenge for SCA, depending on implementation. 
6. The customer’s device is now on file as a trusted authenticator for the user’s payment method.

Using delegated authentication for future transactions

Once a customer is enrolled in delegated authentication, their next checkout flow will look something like this: 
 

1. The customer signs onto a merchant app or website through Single Sign-On (SSO) or an existing session.
2. The customer visits the checkout page.
3. The merchant or PSP prompts a biometric scan on the registered device, and the customer scans their face or fingerprint.
4. The customer’s device generates cryptographic proof that SCA happened locally.
5. The merchant or PSP sends that proof to the issuer through the 3DS flow.
6. The issuer accepts the authentication and approves the transaction.

Under the delegated authentication payment flow, the liability shifts away from the merchant and onto the issuer, the same way it would with a fully authenticated 3DS transaction. 

Does delegated authentication always use biometrics?

Technically, delegated authentication can use any combination of two SCA factors defined under PSD2, which are knowledge, possession, or inherence. Knowledge may be something like a PIN, while possession might be the device, and inherence is often biometric, like a fingerprint or a facial scan (something the user is rather than something they know or have).

In the context of payment security, delegated authentication deployment often leans on device binding with a biometric scan to align with FIDO and passkey standards. Additionally, using biometrics for delegated authentication is what creates the truly frictionless customer experience, breaking away from a traditional login or cumbersome 3DS challenge sent by the issuer.

So no, delegated authentication does not always use biometrics, but for payment security, it’s one of the strongest ways to carry out SCA without breaking the customer flow. 

Delegated authentication use cases

The use cases for delegated authentication are far-reaching and cover a large range of industries. Here’s a look at some of the ways merchants can implement delegated authentication:

1. Hotel and hospitality apps – Hotel apps are an amazing resource for frequent travellers, allowing guests to book stays, order room service, pay for parking, and more. A single stay can generate dozens of payments, and delegated authentication keeps all of a guest’s transactions on the same biometric flow they use to log in. So when a guest checks out, everything is finalised under the same experience. For hospitality merchants running loyalty programmes, reducing payment friction is a top way to encourage repeat stays and more on-site guest purchases.
2. F&B mobile order ahead – Coffee orders should be quick, especially for busy people ordering ahead on their phones. Using delegated authentication to power mobile orders helps reduce checkout friction and encourages continued use due to the simple biometric scan (rather than entering payment or login credentials for every order). At the same time, this system protects the merchants from chargebacks with a full liability shift.
3. Retail loyalty checkouts – No matter the industry, retailers with engaged app and website users often see customers coming back on a weekly or monthly basis. These repeat purchases should feel like one tap, similar to how it would in-store, rather than a heavy four-screen payment flow. Delegated authentication gives returning and loyal customers a frictionless checkout experience, while still keeping fraud rates low for the merchant.
4. Cross-border payments – When it comes to experiences like tax-free shopping, international cards might see a higher decline rate and more aggressive 3DS challenges. But with delegated authentication, certified merchants can authenticate international shoppers locally on their devices, which improves acceptance rates and reduces cart abandonment that’s common with cross-border purchases.
5. Membership renewals and subscriptions – Recurring payments like memberships and subscriptions already operate on a customer’s existing relationship with a merchant. By leveraging delegated authentication in these scenarios, it’s much easier for customers to renew memberships or upgrade subscription tiers without friction in the payment process. On the merchant side, this keeps renewal rates up and reduces churn from failed authentications. 

Benefits of delegated authentication 

Delegated authentication comes with numerous benefits on both the merchant and customer side, including:

• Higher conversion rates – Every step in the traditional payment authentication flow is a chance for the customer to jump ship. 3DS challenges are known to negatively affect conversion rates, whether it’s the issuer sending a code to the wrong number, a failed push notification, or a timed-out redirect page. Each of these moments offers the customer an out from their purchase. But with delegated authentication, SCA is handled inside the merchant’s own flow with a single biometric scan, rather than losing a sale to the issuer’s clunky authentication process. 
• Better authorisation rates – Authorisation is directly connected to authentication. If an issuer sees a clean delegated authentication with a signal that SCA happened on a trusted device, they’re more likely to approve the transaction.
• Liability shift on chargebacks – If delegated authentication is implemented properly, it delivers the same liability shift as a fully authenticated 3DS transaction. So if a fraudulent chargeback comes through on a purchase verified with delegated authentication, liability lies with the issuer, not the merchant. This is especially noteworthy for merchants with a large number of CNP transactions, where fraud is the highest. 
• Control over the checkout experience – It’s easy to lose customers if they’re removed from the merchant’s environment, and in most cases, this is exactly what 3DS challenges do. However, under delegated authentication, verification happens directly on the merchant’s site or application, which makes a huge difference for brands invested in user experience. 
• SCA compliance while reducing friction – Under PSD2, SCA is required for almost all CNP transactions in the EU and UK. Delegated authentication allows approved merchants to meet the SCA requirement without introducing friction to their checkout flows. 
• Strong mobile and in-app payments – Delegated authentication is at its best in mobile payment flows. In most cases, biometrics are already built into the device experience since users expect to use their fingerprint or face ID to unlock the phone or carry out sensitive operations. Delegated authentication leans on this expectation rather than working against it, which makes in-app payments feel native in a way they might not have before. 

Integrating delegated authentication as a merchant

Delegated authentication takes time and careful consideration for implementation. To even be eligible, merchants are required to obtain a certification from card schemes, carry out technical integrations with FIDO and 3DS infrastructure, and continually monitor for fraud.

This is what integration actually requires:

• Card scheme certification – approval by either Visa, Mastercard or both, depending on which networks you process as a merchant. Each scheme has its own application and approval process, and both are actively moving towards passkey-based authentication that still works for SCA under PSD2. 
• Fraud rate thresholds – Card networks require merchants to stay below certain fraud rates to keep their certification active. Visa’s Acquirer Monitoring Program (VAMP) sets the merchant “excessive” threshold at 1.5% as of April 2026 (down from 2.2%), while Mastercard has its own Excessive Fraud Merchant (EFM) program with tiered limits. These thresholds are specific to delegated authentication and tend to be tighter than general fraud monitoring caps. If your fraud rate climbs as a merchant, you’ll lose delegated authentication, which is why continuous monitoring is essential to ensure you stay below the scheme thresholds.
• PCI DSS compliance – Delegated authentication isn’t a replacement for PCI DSS. Merchants are still required to comply with these payment security standards. 
• FIDO-based authentication infrastructure – Most modern operating systems and devices can handle biometric verification and generate cryptographic proof. The trick for merchants is ensuring your app or website is set up to use it. 
• 3DS server integration – Delegated authentication still communicates directly with the issuer through the 3DS flow. Your 3DS server (or your PSP’s) must send the correct authentication data to the issuer so it recognises the transaction as delegated and doesn’t run a challenge itself.

• Customer enrolment flow – You’ll need to build in-app or site prompts to let customers opt into delegated authentication, generally by binding their device to the payment method. The flow design matters because a bad enrolment experience can kill the conversion benefits before it even has the chance to work.

   

Because of the heavy implementation, most merchants work with a payment service provider that’s already certified in all these aspects rather than starting from scratch themselves. 

Final thoughts on delegated authentication

Delegated authentication isn’t exactly set it and forget it. It requires real legwork to get the infrastructure up and running and integrated into your current merchant systems.

It also won’t be the right fit for every merchant, especially those with mostly one-time customers or no native app or logged-in user base. Merchants with persistently high fraud rates also won’t even qualify in the first place. So, when thinking about implementing delegated authentication for your business, consider whether you have repeat customers, app or session-based checkout, and a high volume of CNP transactions that make the deployment worth it.

For most businesses, working with a certified PSP like Planet is the fastest and most practical path. The PSP handles scheme certifications, the 3DS server, and most of the heavy lifting for the integration, which leaves your business to focus on the customer-facing elements and your merchant fraud strategy.

Planet supports delegated authentication as part of its broader payment security stack, with enterprise architecture and fraud tooling to keep merchants fully compliant and conversion rates high.