Methods and systems are disclosed for payment authentication. For example, a method may include: the method comprising: storing a first device fingerprint in association with a token representing a primary account number, the first device fingerprint being derived from a device attribute of a user device and behavioral biometric data derived from a behavioral pattern of a user in using the user device; receiving an authentication request indicative of the token and a second device fingerprint generated by a customer device associated with a customer of a merchant, the authentication request being associated with a transaction between the merchant and a customer using the token; identifying the stored first device fingerprint based on the token indicated by the authentication request; and determining whether the second device fingerprint matches the stored first device fingerprint.