From Plastic to Protocol: The Evolution of Payments and Identity

Welcome back to Cracking the Identity Code!

Every good story starts with some world-building, so we'll begin with a short history of payment cards. Understanding the past is key to shaping the future. From there we will  examine the successes of the EMV evolution and explore how its framework can be applied to the future of online identity in ways that will reshape the industry.

From Plastic to Protocol: The Evolution of Payments and Identity

The credit card in your wallet once stood as the pinnacle of payments innovation. For decades, plastic cards were the fastest way to pay, fueling an explosion of global commerce. But behind the convenience of early payment cards were gaping security flaws. Magnetic stripes stored static data that could be skimmed, cloned, and reused, making fraud cheap and easy.

By the 2010s, the payments industry took a new approach that arrived not only as a new card, but as a new protocol: EMV. Its success offers a powerful lesson for how to think about the future of fraud reduction and identity verification in payments and beyond.

The Swipe Era: Convenience at a Cost

When cards became machine-readable with the addition of magstripes, payments could happen at speed and on a global scale . At the time, the technology was considered novel and secure. However, as the fraud landscape evolved, the shortcomings of magstripes became a clear vulnerability. Magstripe cards transmitted the same static account data with each transaction, making it easy for criminals to steal the information and create counterfeits. Fraudsters could simply copy the stripe and make a working duplicate.

Manual verification attempts — comparing signatures, asking for ID — were often skipped or easily bypassed. Merchants were left to rely on trust, even as counterfeit card use surged. As credit cards gained widespread popularity by the 1980s, counterfeit fraud was costing banks and merchants hundreds of millions each year, and the need for a systemic fix became obvious.

EMV Chips: Embedding Trust in Every Transaction

In the early 1990s, Europay, MasterCard, and Visa introduced EMV chips: tiny, tamper-resistant computers embedded in cards. Unlike magstripes, EMV chips generated a unique one-time cryptographic code for each transaction. Copying the data was no longer enough, without the chip’s private keys, a counterfeit card wouldn’t work.

This was a turning point. Even though issuers and merchants were not initially happy about making the switch—with costs assessed at upwards of $30 billion (that’s ~$1-2k per bankable individual in the U.S.)—they soon saw the benefits. Countries that adopted EMV saw in-store fraud plunge. In 2015, in-store fraud was over $3 billion annually in the U.S. In the four years following the adoption of EMV, fraud at chip-enabled merchants dropped by 87%. By 2019, 99% of U.S. payment volume ran over EMV.

EMV didn’t just improve security, it redefined identity verification in card payments. Each chip contained a unique cryptographic certificate issued to the cardholder. Presenting the card said, in effect: This is genuine, and I am its rightful holder. In some markets, Chip-and-PIN added a second factor, making stolen cards useless without the PIN.

The genius of EMV was that it moved verification from a reactive, human process to a proactive, automated one. The network itself could verify legitimacy in real time, reducing reliance on trust at the counter and dramatically improving both security and convenience.

After the Chip: Fraud Shifts Online

Securing card-present transactions didn’t end the fight against fraud, it moved the battleground. As in-person fraud plummeted, online fraud surged. E-commerce became the new target for stolen card numbers, phishing attacks, and account takeovers.

The payments industry responded with new protocols like EMV 3-D Secure, which allowed merchants and issuers to exchange risk data during online transactions and, when needed, step up verification with a one-time passcode or biometric check.

Mobile wallets like Apple Pay and Google Pay extended EMV’s protections into digital payments. They replaced card numbers with “tokens” — unique to the device and merchant — that couldn’t be reused even if intercepted. Biometric authentication tied transactions to the rightful device owner, rendering a stolen phone useless for payments.

Regulators joined the push. In Europe, PSD2 mandated multi-factor authentication for most online payments, further integrating identity checks into the payments process. In some cases, national digital ID programs are now being linked directly to payment authentication — a sign of deeper convergence between payments and identity.

From Physical IDs to Digital Credentials: Identity’s EMV Moment

The leap from magstripe to EMV shows what’s possible when trust is built directly into a network. In identity verification, we’re still in the magstripe era, relying on static, manually verified documents like driver’s licenses or passports. Taking a photo of an ID document was once novel and difficult to fake. Now it's easy to create a fake ID with AI. And, ID documents are passed around repeatedly, stored in countless databases, and exposed to theft. 

The next leap in identity is a portable, cryptographically protected reusable digital identity credential. Instead of scanning and resending your ID every time you open an account, you’d share a verified credential from a secure identity wallet on your phone. The receiving bank or service could instantly confirm it using public-key cryptography, without repeating the original verification process.

This model is not only faster, it’s safer. With selective disclosure, you can prove you’re over 18 or live at a certain address without revealing more than necessary. Your raw personal data stays with you, not scattered across databases. Just as the payments industry moved away from sharing actual account numbers, a digital ID can prove “you are you” without broadcasting sensitive details.

Early Signs of the Shift

The reusable identity market is projected to reach $266 billion by 2027, with governments and businesses driving adoption. Singapore’s Singpass, the EU’s upcoming EUDI Wallet, and U.S. bank–fintech partnerships all point toward a future where identity credentials are portable and interoperable.

Even EMVCo, the standards body behind chip cards, is exploring how digital identity wallets could be integrated into payment authentication. The line between an “ID transaction” and a “payment transaction” is starting to blur — both are secure exchanges of credentials at their core.

Toward a Universal Financial Identity Protocol

Driving down rising fraud rates will come from making identity as portable and trustworthy as our payment cards. A persistent digital identity layer could slash identity-driven fraud, reduce compliance costs, and make onboarding customers nearly instant.

This transition won’t come without tradeoffs. Just as issuers and merchants were initially skeptical of the EMV transition, industries are showing similar hesitation toward digital identity. While initial investments may increase, they should look more like a budget reallocation rather than a new expense. Today, financial institutions spend over $200 billion on compliance checks, but much of that spending stems from systemic inefficiencies and the need for repeated customer verifications. A digital identity would solve this problem, cutting duplication and catching bad actors earlier.

Portable identity also makes legitimate transactions faster and simpler, improving customer experience while protecting against fraud. Identity verification has historically centered around presenting and validating an ID. With AI changing the landscape, we need to move beyond presentation, to verifying transactions with identity, similar to how cardholders use cryptograms to digitally sign and authorize transactions. ‘Identity-signed records,” will mean that our  online actions are backed by a verifiable record with a cryptographic digital identity. Regulators are already calling for more identity-aware financial systems, and the institutions that move early will gain a competitive edge.

The Road Ahead

We’ve already seen the transformation from plastic to protocol in payments. Now the same evolution is coming for identity. The technology is maturing, standards are emerging, and incentives are aligning.

In the next installment of “Cracking the Identity Code” will delve into what it takes to build a truly portable identity credential – the remaining challenges and the emerging solutions that could finally let identity travel as safely and seamlessly as money does. The evolution is underway, and the institutions that recognize identity as the new linchpin of trust will be best positioned to thrive in a digital, borderless economy.