A fast payment step reuses an identity the shopper has already proved instead of asking for a new one
On 9 March 2023 PYMNTS published an interview with Emily Foshee, then vice president of core products at Discover Global Network, on instant and unattended checkout in physical stores. Most of it describes a retail trend that the pandemic had accelerated: paying in apps, buying online and collecting in store, and a payment terminal that moves with the customer instead of standing at the front of the shop. The interview contains no survey data and should be read as one practitioner’s view from 2023. Its useful point sits in the middle. Foshee treats authentication as the question that decides whether instant checkout works: how a retailer confirms who the customer is without damaging the experience, at the risk of losing the sale.
That framing turns the usual order of checkout work around. Teams tend to start with speed, counting screens and fields, and treat verification as a hurdle added at the end. Foshee describes the reverse. The shopper starts on the phone, where identity is already confirmed through biometrics and the app, and later walks out of the store having approved the payment with a tap or a wave. The checkout is quick because the question of who is paying was settled earlier, not because a step was removed.
The phone already knows who is paying
Part of what Foshee described already runs on that principle. Apple’s own security overview states that a shopper paying in a store with Apple Pay must authenticate with Face ID, Touch ID or the device passcode, except in Express Mode with a payment or transit card, and that the merchant receives a device account number with a security code specific to that transaction, not the card number. The card was linked to the device once, with the bank. After that, a payment is confirmed with the same face, fingerprint or passcode the shopper uses to unlock the phone.
Since the interview, the same model has moved towards online checkout. In June 2024 Mastercard committed to 100% e-commerce tokenisation in Europe by 2030, as part of a goal to phase out manual card entry, and described payment passkeys that use biometric authentication on the phone to replace passwords and one-time codes. Visa describes a comparable payment passkey in its developer documentation: the shopper approves a payment the way they open their phone, with no password or code to type, and the fingerprint or face scan never leaves the device. Mastercard’s date is a target for the end of the decade, not a launch in your checkout. Both announcements point the same way: the identity check moves to the device, and happens before or during the payment rather than as a separate screen after it.
Count how often your checkout asks who the shopper is
Seen from the shopper’s side, many checkouts ask the identity question more than once. A login before the delivery step. A card form, where the shopper shows they hold the card by typing a long number from it. A code by text message, or a confirmation in the banking app. In a store with click and collect, sometimes a printed confirmation or an ID at the counter as well. Each of these may have a reason. Together they turn one decision to buy into a series of small checks, and every check is a point where the shopper can stall, lose a code or give up.
The fix is rarely to remove the check that protects the payment. It is to stop asking for proof the shopper has already given. Do not make a login the condition for paying when a wallet on the device can carry the payment and its authentication in one step. Show wallet buttons on the devices that support them, early enough that the shopper has not already started typing a card number. Where an order is paid online and collected in a store, let the store recognise the paid order from a code the shopper received, instead of asking them to prove again who they are.
Look as well at what happens when the identity step fails. A face that is not recognised or a passkey that is not available on a new phone should fall back to the device passcode or another method on the same screen, with the basket intact. A shopper who is sent back to the start to prove the same thing again experiences the fallback as a second checkout.
Trust is part of the design, not a line in the privacy policy
Foshee’s advice to merchants was to educate shoppers about features such as scan and go, reassure them about the security of their data and explain why a faster checkout benefits them. In a webshop the moment for that is precise. It is the screen where the shopper is invited to save a card, set up a passkey or stay logged in. At that point the shopper decides whether to hand over something lasting, and the text next to the choice does more work than any policy page.
Say in one or two plain sentences what is stored and where. With Apple Pay, according to Apple, the card number does not reach your shop. With Visa’s payment passkey, the biometric data stays on the shopper’s own device. Say how the shopper removes a saved card later, and make that path real in the account. A shopper who knows how to undo a choice makes it more readily, and a shopper who did not know a card was stored reads the next quick charge as a surprise.
Start with a list. Walk your checkout on a phone, then the click and collect route if you have one, and write down every moment the shopper has to prove who they are: login, card entry, code, banking app, counter. For each one, note whether an identity proved earlier could replace it, and whether the screen explains why it is asked. Remove the duplicates first, starting with the step closest to the payment.
Sources: pymnts.com, support.apple.com, mastercard.com and developer.visa.com
