Topic starter
11/07/2026 8:25 pm
TL;DR: Passkeys reached mainstream adoption in 2025, with nearly 70% of users holding at least one passkey, while regulators in the UAE, India, the Philippines, and the US moved away from SMS OTP and toward phishing-resistant authentication, according to Authsignal. Passwordless is no longer a pilot topic; it is becoming the baseline for identity programmes that need to survive fraud pressure and compliance deadlines.
Editorial analysis by NHI Mgmt Group, based on content published by Authsignal: “Passwordless authentication in 2025: The year passkeys went mainstream”.
By the numbers:
- Nearly 70% of users would have at least one passkey by the end of 2025, according to Authsignal.
- Passkeys reached a 93% login success rate compared to 63% for traditional authentication methods, according to Authsignal.
Key questions
Q: What should IAM teams do first when OTP and SMS MFA are still in use?
A: Start by moving privileged users, administrators and anyone who can reset access into phishing-resistant MFA first.
Q: Why do SMS OTPs create higher fraud and recovery risk than device-bound authentication?
A: SMS OTPs only prove control of a phone number, and that signal is easier to spoof, intercept, or divert than a cryptographic credential tied to a device.
Q: How can IAM teams tell whether passkey adoption is actually working?
A: Look for lower password-reset volume, shorter login times, reduced phishing-related incidents, and a declining share of applications that still require phishable methods.
Practitioner guidance
- Retire SMS OTP from high-risk journeys Remove text-message and email codes from flows that protect payments, account recovery, and privileged access.
- Prioritise phishing-resistant MFA for regulated users Move customers, staff, and administrators who handle financial transactions or sensitive actions onto passkeys or other phishing-resistant authenticators first.
- Design passkey lifecycle governance end to end Treat enrolment, recovery, revocation, account changes, and credential-manager updates as one lifecycle, not separate projects.
Bottom line: Passkeys moved from early-adopter status to mainstream authentication in 2025, and the article shows that this shift is being reinforced by both regulators and platform changes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 8:54 pm
SMS OTP is now a governance liability, not merely a weaker factor. The article shows that regulators are no longer treating text-message codes as an acceptable control for high-risk authentication. That matters because many identity programmes still use SMS as a fallback that feels convenient but creates a shared-secret style failure mode. Practitioners should read this as a signal to reclassify SMS OTP from default MFA to legacy exception handling.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: Should organisations treat phishing-resistant MFA as a compliance issue or an architecture issue?
A: Both, but the architecture comes first. Regulations and standards are now pushing toward phishing-resistant authentication, yet the control only works when enrollment, recovery, device trust, and exception handling are designed together. If those pieces are separate, compliance will be fragile and user friction will rise.
👉 Read our full editorial: Passkeys went mainstream in 2025 as SMS OTP lost ground