Mastercard and Google Pay target biometric card authentication in India via CDCVM

Mastercard and Google Pay have announced a collaboration to bring device biometric card payment experiences to Google Pay users through eligible issuing banks, according to a BusinessWire India wire published on 16 September 2026 and picked up by ETBFSI. The partnership was previewed at the Global Fintech Fest (GFF) 2026 in Mumbai and is focused on the Indian market.

What the collaboration involves

The solution would allow cardholders to authenticate card payments on Google Pay using the fingerprint or facial recognition capabilities built into their smartphones, rather than relying on a separate verification step. The technical mechanism is Mastercard's Consumer Device Cardholder Verification Method, or CDCVM — a single-source detail drawn from the ETBFSI primary source that has not been independently confirmed by a second readable source in this coverage cycle.

Participation is conditional: only transactions processed through eligible issuing banks would qualify, though the announcement did not specify which banks have committed or when the feature would be broadly available to cardholders.

The collaboration is framed around reducing consumer reliance on one-time passwords by enabling the biometric capabilities already present on modern smartphones to serve as the authentication layer for card payments.

Why India, and why now

The announcement was made in Mumbai and is explicitly India-focused. India maintains an additional factor of authentication framework for card-not-present transactions under the Reserve Bank of India's regulatory requirements — a framework that has historically made the OTP a near-universal step in digital card payments. By routing authentication through CDCVM rather than a separate OTP channel, the collaboration is positioned as a way to reduce that reliance while remaining consistent with the regulatory requirement for a second authentication factor. This regulatory framing is editorial interpretation grounded in publicly established RBI policy; readers should treat it as contextual analysis rather than a company-stated claim.

GFF is an established venue for payments-industry announcements in India, and the choice to preview the solution there is consistent with its India-market focus.

How CDCVM works in this context

CDCVM is a Mastercard-defined cardholder verification method that delegates the authentication decision to the device itself — specifically to the biometric hardware and operating-system security layer of the smartphone. When a cardholder completes a fingerprint scan or face recognition on their device, the result is passed to the payment network as a verified authentication signal, without requiring the merchant, bank or network to transmit a one-time code.

This approach is distinct from a full OTP elimination: the ETBFSI primary source describes reduced reliance on OTPs rather than a confirmed phaseout, and any characterisation of the collaboration as ending OTP use entirely goes beyond what the verified source material supports.

Parties and structure

The collaboration involves Mastercard as the network and technology provider, Google Pay as the consumer-facing wallet, and eligible issuing banks as the third leg of the arrangement. The issuing bank's eligibility is a structural prerequisite; the announcement does not describe the criteria banks must meet to participate.

No financial terms, licensing arrangements or timeline for commercial availability were disclosed in the source material reviewed.

Editorial context

In regulatory terms, the significance of this announcement for India's payments market lies in the intersection of device-level biometrics with an existing strong-authentication mandate. Whether CDCVM satisfies the RBI's additional factor of authentication requirements for all transaction types is a compliance question that the available source material does not answer; that determination would rest with individual issuing banks and their regulatory dialogue with the central bank.

The GFF 2026 preview positions this as a near-term initiative rather than a live product. Analysts and industry observers will likely watch which issuing banks move first to enable the feature and whether uptake is sufficient to meaningfully shift authentication patterns in India's card payment ecosystem.