Passwords have long been part of banks’ authentication processes, but their role has diminished significantly. Passwordless Authentication goes a step further by eliminating the use of shared secrets altogether and replacing them with credentials that are resistant to phishing and large-scale compromise attacks.
Vulnerabilities Persist in Banking Authentication
Account takeover fraud remains one of the most serious threats to digital banking. Although many banks no longer use passwords as a standalone authentication factor, current authentication and account recovery processes still rely on mechanisms that can be exploited through phishing, information interception, or social engineering.
Recent industry analyses indicate that criminals are shifting towards identity-based attacks. According to TransUnion’s latest fraud trends report, account takeover and identity impersonation are accounting for an increasingly large share of fraudulent activities.
In practice, attackers commonly use the following methods:
- Real-time phishing and social engineering attacks.
- Malware and session hijacking.
- SIM swapping and OTP interception.
- Exploitation of insufficiently secure account recovery processes.
Credential database breaches remain a significant concern. Even when passwords are securely stored using modern hashing algorithms in secure services such as online banking platforms, the risk of compromise can still originate from data breaches at other services, as users often reuse the same passwords across multiple platforms.
Credential stuffing attacks continue to occur on a large scale across digital services, with billions of automated login attempts each year. According to data from Cloudflare and NordPass, more than 50% of authentication attempts involve passwords that have previously been exposed. Although banks are generally less directly affected by this threat, certain scenarios, such as mobile application reactivation, may still present vulnerabilities.
SMS-based OTPs cannot fully resolve the problem either. The FBI Internet Crime Complaint Center (FBI IC3) continues to warn about real-time phishing attacks in which one-time passcodes are intercepted and login sessions are hijacked.
As a result, modern banking security is shifting away from protecting shared secrets towards eliminating them wherever possible. For banks, this transition is not simply about replacing passwords; it represents a fundamental architectural shift towards modernization, phishing-resistant authentication, and up-to-date security solutions.
What is a Passkey?
A passkey is a cryptographic key designed to replace passwords. While traditional passwords can easily be stolen, hacked, or guessed, passkeys operate on a fundamentally different principle, using public-private key pair authentication. Unlike passwords, passkeys cannot be shared, remembered, or written down. This makes them far less vulnerable to the types of attacks that commonly target password-based systems.
While early biometric authentication technologies laid the foundation for identity verification, the journey towards passkeys began in 2012 with the establishment of the FIDO Alliance, whose mission was to eliminate passwords.
The passkey revolution began in 2021, when major technology companies adopted the FIDO2 and WebAuthn standards, enabling passwordless authentication. Today, passkeys have become an authentication method accessible to billions of users worldwide.
A significant milestone in the evolution of passkeys was the National Institute of Standards and Technology (NIST) formally recognizing synced passkeys in its supplement to the SP 800-63B guidelines: NIST SP 800-63B Supplement.
This recognition highlights the phishing-resistant nature of passkeys while demonstrating their potential to replace traditional passwords with a more secure, convenient, and user-friendly authentication method.
With NIST’s recognition, passkeys are well positioned for widespread adoption, particularly in highly regulated industries such as banking and healthcare. This is expected to drive the next phase of secure digital identity verification.
The Difference Between Passkeys and Passwords
- Every passkey is inherently strong – Users do not need to worry about whether a passkey is long or complex enough.
- Passkeys cannot be guessed – Based on public-key cryptography, passkeys do not rely on personal data or easily predictable information for authentication.
- Passkeys are not stored on servers – Unlike passwords, passkeys are stored locally on the user’s device and are never shared with the websites or services they sign in to.
- Phishing-resistant by design – WebAuthn ensures that the private key can only be used to authenticate with the correct registered domain. Even if a user interacts with a fake website, that website cannot obtain the user’s credentials.
- Seamless user experience – Passkeys provide a convenient, fast, and frictionless sign-in process, significantly improving the overall user experience.
A Variety of Authentication Devices
In practice, banks rarely standardize on a single type of authentication device for all users and every scenario. Individual customers, corporate users, older adults, users requiring accessibility support, and high-risk transaction processes often require different authentication methods with varying levels of assurance.
As a result, many banks are shifting towards a multi-authenticator strategy rather than replacing all existing authentication methods with a single passkey-based model.
Platform Authenticators
Platform authenticators are often the simplest starting point for passkey adoption. Built into devices and operating systems, these solutions use hardware-backed security mechanisms such as Secure Enclave or Trusted Execution Environment (TEE).
Users authenticate using biometrics or their device PIN. Credentials are protected directly on the device and are not disclosed to the server.
The level of security and assurance depends on the implementation, particularly whether credentials are synced across devices or bound to a specific device. Potential limitations include the level of assurance and scope of support, as synced credentials depend on the platform ecosystem, while not all users own compatible devices.
In banking, these solutions can be introduced as a phishing-resistant authentication component within existing Strong Customer Authentication processes.
Hardware Security Keys
Hardware security keys address limitations in support coverage and assurance levels. They operate independently of mobile devices, offer resistance to malware and session tampering, and support secure transaction confirmation.
They are essential for corporate banking, high-value transactions, and scenarios requiring a backup authentication method to meet regulatory requirements.
Current Regulatory Requirements
PSD2 and Strong Customer Authentication (SCA)
PSD2 requires the use of two independent authentication factors and dynamic linking for payments.
FIDO2 can meet Strong Customer Authentication (SCA) requirements when implemented as device-bound passkeys or security keys, together with appropriate user verification mechanisms. In this model, the device provides the possession factor, while a PIN or biometric authentication can provide the knowledge or inherence factor, respectively.
FIDO2 also goes beyond basic requirements through its phishing-resistant capabilities.
PSD3/PSR: Upcoming Changes
PSD3/PSR reached a political agreement in 2025 and is expected to begin implementation from 2026 onwards, with a transitional timeline extending into 2027 and 2028.
One of the most notable aspects of PSD3 is the strengthened requirement for Strong Customer Authentication. SCA is no longer limited to payment authentication, but is also extended to a wider range of customer actions, such as changing transaction limits, updating contact information, restoring devices, setting up authorization, or changing authentication methods. Strong authentication is becoming an integral layer across the entire customer journey.
Under the latest directive, PSD3 also reinforces the responsibility of payment service providers in fraud prevention. When incidents occur involving authentication failures or suspicious transactions, legal liability must be clearly defined. This is a key driver for financial institutions to invest more heavily in multi-layered authentication, risk analytics, transaction monitoring, and digital identity protection.
Global Regulatory Alignment
This trend is taking place worldwide. The US Cybersecurity and Infrastructure Security Agency (CISA) recognizes FIDO and WebAuthn as phishing-resistant multi-factor authentication solutions.
The NIST SP 800-63B standard places properly implemented hardware-bound FIDO2 solutions at the highest assurance level.
Regulatory authorities in the UAE introduced stricter authentication requirements in 2025, reducing reliance on OTP-based methods. Singapore continues to lead in the adoption of anti-phishing measures.
Historically, passkey adoption in banking has progressed more slowly due to regulatory and support limitations. However, the current trend is clear: passkeys are increasingly being deployed in banking, and the sector is expected to become one of their largest application areas.
Therefore, the challenge for banks is not simply to deploy passkeys, but to build an authentication architecture capable of supporting multiple types of authenticators, adapting to evolving regulations, and meeting future security requirements without repeatedly redesigning the customer experience.
SAVYINT: Advancing Secure Authentication with PKI Tokens, Smart Cards and NFC
As banks and enterprises accelerate their transition toward passwordless authentication and phishing-resistant security, SAVYINT provides a range of solutions designed to support secure digital identity, authentication, and cryptographic operations. Its product portfolio includes PKI Tokens, Smart Cards, and NFC-enabled solutions, supporting secure credential storage, digital certificate-based authentication, and trusted access to digital services. By combining PKI-based security with flexible authentication technologies, SAVYINT helps organizations strengthen identity assurance, protect sensitive transactions, and advance their digital trust capabilities in an evolving security landscape.
To learn more about SAVYINT’s secure authentication solutions and explore how they can meet your organization’s needs, contact SAVYINT to connect with our experts.
Reference: https://www.wultra.com/blog/passwordless-authentication-in-banking-a-guide-to-fido2-passkeys
