Topic starter
06/06/2026 11:07 am
TL;DR: Passkey adoption in banking combines higher sign-in completion, faster authentication, and resistance to credential stuffing, phishing, and adversary-in-the-middle attacks, according to OneSpan’s RSAC 2026 discussion with The Defenders Initiative. The practical shift is not passkeys alone, but staged rollout, recovery design, and coexistence planning that make consumer behaviour change achievable.
Editorial analysis by NHI Mgmt Group, based on content published by OneSpan: “Passkeys for banking: A conversation with CyberRisk TV”.
Key questions
Q: What breaks when banks replace passwords with passkeys too quickly?
A: Banks usually break the user journey, not the cryptography, when they switch too fast.
Q: When should banks prioritise passkeys over SMS or push MFA?
A: Banks should prioritise passkeys when the main goal is to reduce phishing and credential replay while also improving completion rates.
Q: What are the signs that a passkey deployment is failing?
A: A passkey deployment is failing when users cannot recover access after losing a device, when teams over-rely on a single device with no fallback, or when sign-in still depends on passwords for routine access.
Practitioner guidance
- Design passkeys as a full journey Map onboarding, sign-in, and account recovery as one control path so the same assurance level is maintained across each user touchpoint.
- Roll out by channel or region Use a phased deployment to one platform, geography, or customer cohort first so you can measure completion, latency, and fallback behaviour before broader release.
- Make mobile the first adoption path Prioritise mobile for initial passkey adoption where biometric familiarity and device gestures reduce behavioural resistance.
Bottom line: Passkeys reduce banking friction and close off password-era attack paths, but only if the full authentication journey is redesigned around them.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 11:44 am
Passkeys do not just improve authentication, they remove an entire class of shared-secret governance assumptions. Banking authentication has long assumed that a reusable credential can be protected, recovered, and re-entered safely across sessions. That assumption is weaker once authentication is device-bound, origin-bound, and resistant to replay. The practical consequence is that identity teams must stop treating password replacement as the main event and start treating control-plane redesign as the real work.
A few things that frame the scale:
- eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.
A question worth separating out:
Q: How should security teams roll out passkeys without disrupting existing authentication flows?
A: Start with applications where phishing risk and user friction are both high, then introduce passkeys alongside current methods while you preserve enrolment, recovery, and audit continuity. The goal is not a big-bang replacement. It is to reduce shared-secret exposure while keeping access stable for the users and systems that are not ready to move yet.
👉 Read our full editorial: Passkeys for banking reduce friction without weakening auth