Topic starter
06/11/2026 6:39 pm
TL;DR: Wider passkey adoption, rising consumer sign-in use, and more layered identity fraud controls that combine phone intelligence, device signals, biometrics, and risk-based authentication are expected as AI systems and personal identity increasingly overlap, according to Zumigo.
Editorial analysis by NHI Mgmt Group, based on content published by Zumigo: “It’s Time Again for Our Annual Zumigo Predicts!”.
By the numbers:
- Two thirds of 600 developers in Bitwarden’s 2024 survey had used passkeys to access work applications.
- Almost 90% of those developers had a highly favorable or favorable attitude towards passkeys.
- Passkeys are expected to account for over 50% of consumer sign-ins in 2026.
Key questions
Q: How should security teams roll out passkeys without breaking account recovery?
A: Start with low-risk journeys, then define recovery as a controlled identity workflow rather than a convenience feature.
Q: Why do single-signal identity checks fail against modern fraud patterns?
A: Single-signal checks fail because they rely on one observation, such as a document image or a single device event.
Q: How do AI agent identities change access governance compared with human users and service accounts?
A: AI agents can require task-specific access that is created, used, and retired differently from human or static machine accounts.
Practitioner guidance
- Standardise passkey enrollment and recovery controls Require phishing-resistant enrollment, restrict fallback methods, and review account recovery paths for abuse opportunities before scaling passwordless sign-in.
- Fuse identity signals into a single fraud decision path Combine device reputation, phone intelligence, behavioral risk, and document checks so step-up decisions are made from correlated evidence rather than one score.
- Separate human intent from agent action Document which actions an AI assistant may initiate, what user approval is required, and where revocation or reauthentication must occur.
Bottom line: Passwordless authentication lowers exposure to stolen credentials, but it shifts risk toward enrollment, recovery, and device-binding controls.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Passkeys are becoming a baseline control, but they do not end identity fraud. Passwordless authentication removes a large class of credential theft, yet fraudsters shift to account recovery, device compromise, and social engineering around enrollment. The governance problem moves from secret protection to trust in the binding process. Identity programmes should treat passkeys as necessary but not sufficient, because the weak link becomes the surrounding lifecycle.
A question worth separating out:
Q: What is the best way to reduce consumer account takeover risk?
A: The best way to reduce consumer account takeover risk is to combine strong login controls with fraud detection and step-up verification. Use phishing-resistant MFA where possible, monitor unusual device, location and session behaviour, and trigger step-up checks for risky changes such as password resets, new payees or profile updates. Rate limiting, breached-password checks and secure account recovery close common takeover paths.
👉 Read our full editorial: Passkeys and multi-signal verification reshape identity fraud controls