Quick answer
A passkey is a sign-in credential based on FIDO standards that lets you log in with the same fingerprint, face, PIN or pattern you use to unlock your device[1]. It uses public-key cryptography and, unlike passwords and one-time codes, is phishing-resistant[3].
Key points
- A passkey is a pair of cryptographic keys: the private key stays with you, the public key is stored by the bank.
- There is no password or code to type, so a fake website has nothing to steal.
- Synced passkeys copy across your devices through a credential manager; device-bound passkeys stay on one device or security key.
- US government guidance from NIST requires services at its middle assurance level to offer at least one phishing-resistant option.
- Singapore's central bank announced in 2024 that major banks would phase out one-time passwords for login by digital token users.
On this page
#What is a passkey in plain English?
The FIDO Alliance, the industry body that writes the standards behind passkeys, defines a passkey as a FIDO authentication credential that lets you sign in to apps and websites with the same process you use to unlock your device: biometrics, a PIN or a pattern[1]. Instead of remembering a secret and typing it in, your phone or computer proves who you are on your behalf.
Under the hood a passkey is a pair of keys created with public-key cryptography, a kind of maths where one key locks and a different key unlocks. The private key stays on your device, and the public key is shared with the website or service[1]. The W3C Web Authentication (WebAuthn) standard describes the sign-in: the service sends a challenge, the authenticator replies with a digitally signed message, and the service checks it with the public key stored at registration[2]. Your fingerprint or face never leaves the device; the server only sees an assurance that the check succeeded[1].
Signing in to a bank with a passkey
- Open bank app — or the bank's website
- Bank challenge — a one-off random value
- Unlock device — face, fingerprint or PIN
- Device signs — private key never leaves
- Bank verifies — with stored public key
#Why are one-time codes no longer enough?
For years banks added a one-time password (OTP), a short code sent by text or shown in an app, on top of the normal password. That helps against criminals who only have a stolen password, but a person can still be tricked into typing or reading out the code. The US Cybersecurity and Infrastructure Security Agency (CISA) says text and voice codes are vulnerable to phishing and SIM-swap attacks, and app-generated codes are vulnerable to phishing[3]. The FBI's 2025 alert on account takeover fraud describes criminals posing as bank staff to obtain exactly these codes[4].
Worked example
Worked example: why guessing is not the real threat
A six-digit code has 10 × 10 × 10 × 10 × 10 × 10 possible values. Computed with code, that is 1,000,000 combinations, so a criminal allowed three random guesses has a 3 in 1,000,000 chance, or 0.0003%. The code is very hard to guess, which is why criminals do not guess it: they ask you for it on a fake page or a phone call and use it within seconds.
- Possible six-digit codes
- 1,000,000
- Chance with 3 random guesses
- 0.0003%
- Chance if the victim reads the code out
- The criminal has the real code
Regulators have reacted. In July 2024 the Monetary Authority of Singapore (MAS) announced that major retail banks would phase out OTPs for bank account login by customers who are digital token users within three months, because scammers could more easily phish for OTPs, for example through fake bank websites that closely resemble the genuine ones[5].
#What makes a passkey phishing-resistant?
CISA calls phishing-resistant authentication the gold standard for multi-factor authentication and says the only widely available form is FIDO/WebAuthn authentication[3]. WebAuthn is the web standard that browsers use to talk to passkeys. The protection comes from how the passkey is tied to the real service. NIST's digital identity guidelines describe phishing resistance through verifier name binding and channel binding: the authenticator is cryptographically bound to the specific service being accessed, so its output cannot be replayed to a different one[6].
The WebAuthn standard puts it simply: a credential can only be used with the same entity it was registered with[2]. A passkey created for your bank will not work for a look-alike site, however convincing the page looks. You cannot hand it over by mistake because there is nothing to type. NIST's guidelines, finalised in July 2025 as SP 800-63B-4[7], also restrict the use of the telephone network for out-of-band codes and require services at the middle assurance level, AAL2, to offer at least one phishing-resistant option[6].
| Method | What you provide | Phishing risk (per CISA) |
|---|---|---|
| Password only | A secret you type | High: anything typed can be captured |
| Password + SMS code | Secret + code sent to your number | Vulnerable to phishing and SIM swap[3] |
| Password + app code | Secret + code from an app | Vulnerable to phishing[3] |
| Push approval without number matching | Tap 'approve' on your phone | Vulnerable to push bombing[3] |
| Passkey (FIDO/WebAuthn) | Unlock your device | Phishing-resistant[3] |
#What is the difference between synced and device-bound passkeys?
The FIDO Alliance describes two types. Synced passkeys are copied across your devices through the cloud by your credential manager, so a new phone can use them. Device-bound passkeys stay on a single device, including hardware security keys[1]. NIST notes that some cryptographic authenticators let the user copy the secret to additional devices, usually via a 'sync fabric', and treats such exportable keys as usable at AAL2 or below, while its highest level, AAL3, requires a non-exportable private key and phishing resistance[6].
#Do passkeys count as strong customer authentication?
In Europe and the UK, logins and payments need strong customer authentication: two proofs from different categories. In its 2019 Opinion, the European Banking Authority said a device can evidence possession if there is a reliable means to confirm it, such as device binding that creates a unique connection between the customer's app or key and the device, and it listed fingerprint and face recognition among compliant inherence elements[8]. A passkey unlocked by a fingerprint combines a device you hold with a body feature, but whether a given bank's passkey setup meets SCA is a decision for that bank and its supervisor, so this page makes no blanket claim.
Common beginner mistakes about passkeys
Thinking the bank stores your fingerprint
Your fingerprint or face only unlocks the device; the bank receives a cryptographic signature, not your biometric data.
Assuming passkeys make every scam impossible
They stop stolen-password and fake-login attacks, not you being persuaded to send money to a criminal.
Leaving the old password and SMS codes as an easy backdoor
If a weaker sign-in method still works on your account, criminals will target that instead.
Ignoring device security
Anyone who can unlock your phone can use the passkeys on it, so a strong screen lock still matters.
Passkeys protect the front door of your account. Payment tokens protect your card number once you start paying; see our glossary entry on tokenization and our guide to digital wallets.
The bottom line
Passkeys replace secrets you can be tricked into revealing with a cryptographic signature tied to the real website. That makes them the strongest widely available defence against phishing and account takeover, which is why regulators and banks are moving away from one-time codes. They do not stop you being persuaded to send money, so the old rule still applies: never act on an unexpected call or message.
Frequently asked questions
Does my bank get a copy of my fingerprint when I use a passkey?
No. Your device checks your fingerprint or face locally, and the private key stays on your device; the bank holds only the public key[1].
What happens if I lose my phone?
Synced passkeys can be restored through your credential manager on a new device; device-bound passkeys stay on the lost device or key[1], so you would need your bank's other recovery route.
Why do some banks still send SMS codes?
Each bank chooses its own sign-in methods. In US federal guidance, NIST treats telephone-network codes as a restricted option rather than banning them[6].
Are passkeys a legal requirement for banks?
Not in general. Singapore's MAS announced an OTP phase-out for login by digital token users[5], but that announcement was about retiring one-time passwords for login, not a passkey mandate.
Sources
- Passkeys: passwordless authentication — FIDO Alliance, 2026 Primary
- Web Authentication: An API for accessing Public Key Credentials, Level 3 — World Wide Web Consortium (W3C), 2026 Primary
- Implementing Phishing-Resistant MFA (fact sheet) — Cybersecurity and Infrastructure Security Agency, 2022 Primary
- Account Takeover Fraud via Impersonation of Financial Institution Support (Alert I-112525-PSA) — Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 Primary
- Banks in Singapore to Strengthen Resilience Against Phishing Scams — Monetary Authority of Singapore, 2024 Primary
- NIST Special Publication 800-63B (online version of SP 800-63B-4) — National Institute of Standards and Technology, 2025 Primary
- NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management — National Institute of Standards and Technology, 2025 Primary
- Opinion on the elements of strong customer authentication under PSD2 (EBA-Op-2019-06) — European Banking Authority, 2019 Primary
.jpg){kind=link}
