Passkey Authentication

Passkey authentication is a method of signing in to an account, or confirming a payment, without a password or one-time code. A passkey is a pair of cryptographic keys created for one specific website or app. The private key stays on the user's device or in their password manager, and the public key is held by the service. To authenticate, the user unlocks the passkey with a fingerprint, face scan or device PIN, and the device signs a challenge from the service with the private key. Banks, payment providers, card networks, merchants and crypto platforms are adopting passkeys to reduce fraud and make logins and checkouts faster.

Passkeys are built on standards developed by the FIDO Alliance and the World Wide Web Consortium, known together as FIDO2, which includes the WebAuthn browser interface. Major operating system providers announced broad support for passkeys in 2022, allowing them to be synchronised across a user's devices. Passkeys are a form of multi-factor authentication in a single step: the user must have the device holding the key and must unlock it with a biometric or PIN.

When a user creates a passkey, the device generates a new key pair using public-key cryptography. The public key is registered with the service, together with an identifier, while the private key is stored securely, often in hardware such as a phone's secure enclave. The passkey is tied to the service's domain, so it will only work on that genuine website or app.

At login or payment, the service sends a random challenge. The user's device asks the user to confirm with a biometric or PIN, then signs the challenge with the private key and returns the signature. The service checks it using the stored public key. No shared secret is ever sent over the internet or stored on the server, and the biometric data itself never leaves the device.

Passkeys can be synced, meaning they are backed up and available on all of a user's devices through a cloud account, or device-bound, meaning they exist only on one device or security key. Banks and regulated services consider these differences when deciding which passkeys to accept for high-risk actions.

Passwords and codes sent by text message are the targets of many common attacks. Passkeys resist several of them:

• Phishing. Because a passkey only works on the domain it was created for, a fake website cannot obtain a usable credential, which defeats most phishing attempts.
• Credential stuffing. There is no reused password to steal from one site and try elsewhere, so credential stuffing has nothing to work with.
• SIM swapping and code interception. No one-time password is sent by text, so attackers who take over a phone number through SIM swapping cannot intercept it.
• Server breaches. The service stores only public keys, which are useless to an attacker who steals them.

These properties make passkeys a strong defence against account takeover, one of the main sources of fraud losses in online banking and e-commerce.

Banks use passkeys for logging in to online and mobile banking and for approving payments. In regions with strong customer authentication rules, such as the European Economic Area and the United Kingdom, a passkey can combine possession of the device with an inherence or knowledge factor, although firms must assess whether a given passkey setup meets the regulatory requirements, including for payment-specific dynamic linking.

In card payments, passkeys can be used to authenticate cardholders during online checkout. Card networks have introduced payment passkey services that let cardholders confirm purchases with a fingerprint or face scan instead of a code, often working alongside 3-D Secure 2. The W3C has also developed Secure Payment Confirmation, a browser standard that shows payment details and uses a passkey-style credential to confirm them. These approaches aim to reduce checkout abandonment caused by slow code-based challenges.

Adoption faces several practical obstacles. Users may be unfamiliar with passkeys and unsure what happens if they lose a device, so services need clear recovery processes; weak recovery, such as falling back to a text message code, can undo the security benefits. Synced passkeys depend on the security of the user's cloud account. Shared or older devices may not support passkeys, and some regulated services must keep other authentication methods available for accessibility. Finally, passkeys do not stop all fraud: scams in which a customer is persuaded to approve a payment themselves, such as authorised push payment fraud, still succeed because the genuine user completes the authentication.