Identity at checkout: why payments must prove more and share less
By Alpesh Patel, Strategic Partnership Director at Cartex
By the end of 2026, EU member states are required to make at least one European Digital Identity Wallet available to citizens and residents. Apple and Google already let users create a digital ID that sits in the same app as their payment cards or boarding passes. While it may be really convenient to have a payment card and a government credential one swipe apart, it also creates a new challenge for the businesses that issue and run the cards inside those wallets.
So payment companies now have to decide how customers must prove that they are legitimate payers, and how much personal information they need to disclose to do so.
Bringing identity and authentication into one checkout
Until recently, an online purchase involved three separate stages. A customer needed to identify themselves, usually by logging in, then authenticate with a password or a digital code, and only then would the card authorise the payment.
This chain broke with the arrival of wallets, which on the surface merge these moments into a single check. A tokenised card already carries a cryptographic proof that it is bound to a device. Biometric unlock helps confirm that an authorized user has access to the device, while a digital ID can provide additional assurance about that person's identity. The checks still run in sequence behind the screen, but the user sees a single action.
These three layers, however, still run on their own rules. 3-D Secure follows EMVCo specifications, passkeys must meet FIDO standards, and digital IDs follow eIDAS or ISO mobile ID formats. Passing them all simultaneously is challenging, and, importantly, a merchant should not have to do it themselves. Providers between all sides of a purchase need to line them up behind one interaction, so checkout asks the customer for less while verifying more. And merchants are, of course, much more likely to choose the partner that covers all these steps through a single integration.
Proving more by sharing less
Merging these checks into a single tap raises a question: how much of a person’s identity should be visible in the payment process? When identity data connects to payment credentials, it risks exposing personal information. For this reason, I believe a payment system should have access to it as little as possible. For many purchases, the payment system needs assurance that the credentials are valid and the transaction has been properly authenticated, not access to the customer's wider identity record. There is no reason to share additional details such as a date of birth or passport number when they have no bearing on the payment decision.
This principle is already built into European regulation, and the EU Digital Identity Wallet relies on selective disclosure: a user can prove they are over 18 with a simple yes-or-no answer, without the merchant seeing an actual date of birth. Alongside protecting customers’ data, this approach also makes clear economic sense.
Every extra piece of information collected at checkout must be stored and protected, which matters since a breach in financial services costs 26% more than in other industries. Bringing identity and payments together, then, should never mean a payment carries the whole identity along with it; done properly, it only needs to provide evidence about the person through fewer data points. Payment companies need to review what personal data their checkout asks for and keep only what decisions actually depend on.
Who pays when authentication fails to stop fraud?
A payment that carries fewer data points, however, has to make each of them count. If the proof that a payment was legitimately authorized turns out to be weak, someone has to cover the loss. European regulation is now deciding who should be held responsible, and this problem is becoming increasingly important for the EU, as payment fraud there grew by 20% in a single year. It also shows how much the quality of proof matters, as card fraud was significantly higher when the recipient was located in regions where strong customer authentication is often not applied.
The new regulation the EU agreed on this year shifts more of that responsibility onto providers, who carry the losses if they fail to monitor transactions properly and a payment turns out to be fraudulent. Under the agreed EU payment rules, providers would face expanded reimbursement obligations when customers are deceived by fraudsters impersonating their payment provider. The rules also place greater responsibility on providers to monitor transactions and prevent fraud, even when a customer has authenticated a payment. In practice, a check that phishing can bypass no longer shields the provider from the loss.
Under these rules, authentication strength becomes a trade-off between build and operating costs. Weaker checkouts are cheaper to launch, but they become much more expensive over time because of potential refunds. That’s why providers that can merge all required steps behind one tap and ask for less data will carry less risk.
Payment providers should use the next two years to prepare for the rollout of EU digital identity wallets and new payment rules, designing checkout around tokenization, passkeys and risk-based authentication. The goal should be to verify more with less friction and less unnecessary personal data. As more digital wallets integrate with IDs, merchants and customers will choose payment providers based on how securely and easily they can prove who is paying.
About the author
Alpesh Patel is Strategic Partnership Director at Cartex, a new-gen fintech marketplace. He is a senior executive with over 25 years of experience in fintech, cryptocurrency, card issuing, and payments sectors in the U.K. and globally.
