Topic starter
11/07/2026 8:40 pm
TL;DR: Merchants are increasingly using agentic AI for chargeback documentation and refund review, while passkeys are moving from pilot to practice as credential stuffing and phishing continue to drive account takeover, according to Sift and cited FIDO Alliance and NIST guidance. The governance challenge is no longer authentication alone, but trust, measurement and identity resolution across the customer journey.
Editorial analysis by NHI Mgmt Group, based on content published by Sift: “3 Themes from the MAG-Sift Merchant Meet-Up: Agents, Passkeys, and Identity Trust”.
Key questions
Q: What breaks when merchants rely on passwords and recovery flows for customer authentication?
A: Password-based access collapses when phishing and credential stuffing scale faster than user education or manual review.
Q: Why do account takeover controls now affect revenue as much as security?
A: Account takeover distorts approval rates, drives false declines, increases refund abuse, and damages loyalty economics.
Q: What are the signs that passkeys are not enough on their own?
A: Passkeys are not enough when suspicious device changes, abnormal recovery activity, or repeated step-up prompts still appear around otherwise successful logins.
Practitioner guidance
- Expand phishing-resistant authentication coverage Prioritise returning-customer logins, high-value transactions, and account recovery flows for passkey rollout, with fallback paths tightly controlled.
- Bind authentication to device trust signals Combine passkeys with device fingerprinting, trusted-device policies, and step-up checks when behaviour diverges from the normal customer profile.
- Constrain agentic AI to bounded fraud workflows Use human review, auditable decision trails, and clear approval thresholds for chargeback and refund automation so agent actions stay explainable.
Bottom line: Passkeys strengthen authentication, but merchants still need device trust, recovery controls, and fraud correlation to make customer identity reliable.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:08 pm
Passkeys are reducing password risk, but they are not eliminating identity trust gaps. The article shows that phishing-resistant authentication is becoming practical, yet merchants still need device trust, recovery governance, and journey-wide correlation. That is the important distinction: a stronger login does not automatically create a trustworthy customer identity. Practitioners should treat passkeys as one control in a larger identity trust model, not as the model itself.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: How should security teams govern agentic AI in fraud detection?
A: Start by separating detection support from decision authority. Agentic AI can correlate signals quickly, but any action that changes customer treatment, case priority, or compliance status needs explicit policy, traceability, and a human escalation path. Governance should define what the system may recommend, what it may execute, and what always requires review.
👉 Read our full editorial: Agentic AI, passkeys and identity trust are reshaping digital commerce