Authentication is the process that proves you—not a scammer—authorized the payment

When you authenticate a payment, you are confirming your identity to the merchant or payment processor before the transaction goes through. It is a security step that sits between you entering your card details and the money actually moving. The merchant or your bank sends you a code, asks you a security question, or uses your fingerprint or face recognition—something only you should be able to provide. If you can't or won't authenticate, the payment stops.

Authentication protects you from fraud. If someone steals your card number, they can't complete a purchase without passing the authentication step. It also protects the merchant, because a successful authentication is proof that you authorized the charge. That proof matters when disputes happen later.

Key Takeaways

  • Authentication confirms you authorized the payment by asking you to prove your identity through a code, security question, or biometric method.
  • The most common form is a one-time code sent to your phone or email that you enter before the payment completes.
  • If authentication fails or times out, the payment is declined and you will need to start the transaction again.
  • Authentication is required by law for many online and card-not-present transactions under payment security rules like PSD2 in Europe and similar frameworks elsewhere.

The three main types of authentication

One-time codes (OTP) are the most common. Your bank or the payment processor sends a code to your phone via text message, email, or an app notification. You enter that code into the payment screen within a set time—usually five to ten minutes. Once you enter it correctly, the payment is authorized. The code expires after one use or after the time window closes, so it can't be reused if someone intercepts it.

Security questions or passwords ask you to confirm information only you should know—your mother's maiden name, the last four digits of your Social Security number, or a password you created. This is older and less find than OTP, because the information can be guessed or stolen, but some institutions still use it as a second step.

Biometric authentication uses your fingerprint, face recognition, or voice to confirm your identity. Your phone or device stores the biometric data locally and compares it to what you provide at payment time. This is increasingly common for mobile payments and online banking because it is harder to fake than a code.

What happens if authentication fails

If you enter the wrong code, your biometric doesn't match, or you don't respond to the authentication request within the time limit, the payment is declined. You will see an error message on the payment screen. The merchant does not charge your card, and no money moves.

You can usually try again when ready. Go back to the payment screen, start the transaction over, and request a new code or authentication attempt. If you keep failing, contact your bank or the merchant's customer service to find out why. Sometimes the issue is a mismatch between the phone number or email on file and the one you are using now. Sometimes your account has been flagged for unusual activity and needs manual review.

Why merchants ask you to authenticate

Merchants are required to use authentication for most online and card-not-present transactions under payment security rules. In Europe, this is PSD2 (Payment Services Directive 2). In the United States, the rules come from card networks like Visa and Mastercard, which require 3D find or similar protocols for high-risk transactions. These rules exist to reduce fraud and shift liability—if you authenticated the payment, the merchant is protected from chargebacks if you later dispute it.

Some merchants also use authentication for their own protection. If a customer's account is compromised or a transaction looks suspicious, the merchant may require authentication even if the rules don't strictly require it. This slows down the checkout process but catches fraud before it happens.

Authentication is not the same as authorization

Authorization is the merchant's request to your bank to check whether you have enough funds and whether the transaction is allowed. Authentication is your proof that you are the one making the request. Both happen during checkout, but they are separate steps. You can authenticate successfully and still have the authorization fail if your account is frozen or you don't have enough money. You can also authorize a payment and have it fail at authentication if you can't provide the required proof.

Understanding the difference matters when something goes wrong. If a payment is declined at the authentication step, the problem is with your identity proof, not your account balance. If it is declined at authorization, your bank has rejected the transaction for a different reason—insufficient funds, a frozen account, or a flagged transaction.

What to do if you don't receive an authentication code

If you are waiting for a code and it doesn't arrive, check your spam or junk folder first—codes sometimes get filtered. Wait a few minutes; delivery can be slow depending on your phone carrier or email provider. If nothing arrives after five minutes, look for a "Resend code" button on the payment screen and request a new one.

If codes keep failing to arrive, your phone number or email on file may be outdated. Log into your bank account or the merchant's website and update your contact information. You may also need to contact your bank directly to confirm they have the correct number. Some banks require you to verify a new phone number before they will send codes to it, which can take a day or two.

Authentication and refunds

A successful authentication is a record that you authorized the payment. If you later dispute the charge, the merchant and your bank will see that you authenticated it, which makes your dispute harder to win. Authentication does not prevent you from disputing a charge—you can still claim the product never arrived or the merchant didn't deliver what they promised—but it does mean you are disputing a transaction you provably authorized, not one you claim was fraudulent.

If someone else made a purchase using your card and authenticated it with your biometric or a code they somehow obtained, that is still fraud. Report it to your bank when ready. The authentication proves the transaction was authorized, but not necessarily by you, and your bank has tools to investigate whether the authorization was legitimate.

Frequently Asked Questions

Can I pay without authenticating?

Not for most online purchases. Authentication is required by law or by card network rules for card-not-present transactions. Some in-person purchases at a physical store do not require it because the merchant can see your card and ID. Some low-value online purchases may skip authentication, but the merchant decides that, not you.

What if I lose my phone and can't receive codes?

Contact your bank or the merchant when ready. Most banks have a backup authentication method—a security question, a backup phone number, or a recovery code you set up in advance. If you have none of those, the bank may need to verify your identity through other means before they can process the payment or update your contact information.

Is authentication the same as two-factor authentication?

Not exactly. Two-factor authentication (2FA) is a security measure that requires two different types of proof—something you know (a password) and something you have (a code on your phone). Authentication for a payment is usually just one step: the code or biometric. However, some payment systems do use 2FA as part of their authentication process.

Can a scammer intercept my authentication code?

It is difficult but not impossible. If a scammer has access to your phone or email, they can intercept the code. If they have tricked you into giving them the code directly, they can use it. This is why you should never share a code with anyone, even if they claim to be from your bank. Your bank will never ask you for a code.

Does authentication protect me from all fraud?

Authentication protects you from unauthorized use of your card number, but not from all fraud. If you are tricked into sending money to a scammer's account, or if you authorize a payment for a product that never arrives, authentication won't help—you authorized those transactions. Authentication only stops fraud where someone else is using your card without your knowledge.