Click to Pay

EMVCo released the Secure Remote Commerce specifications after an industry consultation, and in 2020 it named every consumer service built on them Click to Pay. The specifications consist of an API and a JavaScript SDK that card networks, payment service providers and merchants implement. A merchant may show the Click to Pay icon once it has signed a trademark license with EMVCo, and the icon tells shoppers that the method works at that checkout.

A cardholder can register a Mastercard through a participating bank, in the Click to Pay area of the Mastercard website or during checkout at selected merchants. At the next purchase, the shopper enters an email address or is recognized automatically, even in a shop the shopper has never used before. When a card expires, the stored data is renewed in the background, and merchants add the method through their payment service provider or their acquirer.

Every Mastercard card registered for Click to Pay receives a token, and Visa states that merchants using the method store and process only a digital placeholder in place of the 16-digit card number. Visa calls such a token worthless if it falls into the wrong hands. Click to Pay builds on the EMVCo token standard that network tokenization covers for stored cards and wallets.

According to its own network data, Visa sees authorization rates up to 11 percent higher than with manually entered card numbers, and in a Visa pilot from 2023 the checkout took up to 20 seconds less. Mastercard aims to tokenize and authenticate all online card payments in Europe by 2030, and in April 2025 almost half of its card-not-present transactions in Europe were already tokenized.

A passkey is a FIDO credential that the shopper unlocks with the same fingerprint, face scan or PIN that unlocks the phone. Version 1.5 of the EMVCo specifications lets consumers create a passkey for the cards in their Click to Pay profile, which can remove the one-time code each time a card is selected. Visa built its Visa Payment Passkey Service on the FIDO standards and integrates it into Click to Pay first, so a biometric check confirms the payment without a password.

Mastercard named Dintero, Netopia and Solidgate as new partners for its payment passkeys, and Netopia Payments describes itself as the first European processor to combine them with Click to Pay. Under the PSD2 rules, the issuing bank asks for strong customer authentication when a payment needs it, and Mastercard states that Click to Pay meets these requirements. Banks use the same FIDO technology for passkeys in online banking, where it replaces the password at login.

Mastercard brought Click to Pay to Germany in 2023 with MediaMarkt and Saturn. In August 2024, Schwarz Digits added it to the Lidl online shop and the Kaufland marketplace, where the Click to Pay logo appears next to the Mastercard logo. In a GfK survey commissioned by Mastercard, 51 percent of consumers in Germany said they would use the method.

Visa announced in September 2024 that Juwelier Christ, Netto and Marktkauf were introducing Click to Pay, and that the direct bank DKB offered enrollment in its banking app. By March 2025, a quarter of the 20 largest online retailers in Germany offered the method or were introducing it, notebooksbilliger.de among them. The Lufthansa Group planned Click to Pay on its booking portals from October 2025, for Lufthansa, SWISS, Austrian Airlines and Brussels Airlines.

Mastercard counted Click to Pay in 26 European markets in June 2025, after enrollments had more than doubled within a year. The new partners for the method included Consors Finanz BNP Paribas, Fiserv, N26, PayU and SIX, as well as the Ogone and Saferpay services of Worldline.

In June 2026, Visa made Click to Pay available to eligible Visa cardholders of Revolut, which has more than 40 million customers across Europe. Revolut also offers the method to merchants in the UK and Europe, who can then show it as a checkout option.

Click to Pay is the name for online checkout services built on the EMV Secure Remote Commerce specifications of EMVCo. The shopper pays from a stored card profile, and the shop receives a token in place of the card number, a technique known as tokenization in payments.

A merchant that uses Click to Pay holds a token, so a data breach at the shop exposes no usable card number. The issuing bank still checks the payment and can ask for a confirmation in its app or for a passkey. In Visa network data from October 2024 to February 2025, Click to Pay showed up to 91 percent less fraud than manually entered card numbers.

A card can be registered through a participating bank, for example in the DKB banking app, or directly during checkout at a merchant that offers Click to Pay. Mastercard holders can also enroll in the Click to Pay area of the Mastercard website. After this one registration, the email address and a confirmation are enough to select the card in other participating shops.

Visa charges merchants no additional transaction fee for Click to Pay, as it stated when it expanded the method in Germany in September 2024. The usual costs of the card payment itself, such as scheme fees and the fee of the acquirer, still apply.

Visa, Mastercard and other EMVCo members run their own Click to Pay systems under the same specifications. EMVCo describes the icon as the sign of a consistent payment experience, whatever card, device or merchant the shopper uses, and licenses it to merchants and other participants.