Topic starter
11/11/2026 6:01 pm
TL;DR: Passkey sign-in is rolling out for GOonline Biznes clients because phishing sites can mimic banking portals and steal passwords, according to Secfense. Banking access now depends less on memorised secrets and more on device-bound authentication that resists lookalike-site capture.
Editorial analysis by NHI Mgmt Group, based on content published by Secfense: “Bank BNP Paribas brings passkey sign-in to GOonline Biznes”.
Key questions
Q: What is the difference between passkeys and passwords for customer authentication?
A: Passkeys are device-bound cryptographic credentials that authenticate a user without exposing a shared secret to the server, while passwords are reusable secrets that users type and servers must store or validate.
Q: How should banks handle passkey recovery for clients?
A: Banks should treat passkey recovery as an identity recovery process, not a simple reset.
Q: How do passkeys stop phishing in banking sign-in?
A: Passkeys stop phishing by binding sign-in to the legitimate website’s origin and using public-key cryptography, so a fake banking page cannot collect a reusable secret.
Practitioner guidance
- Define the passkey rollout scope Start with sign-in only, then decide where password fallback remains acceptable and where it should be removed later.
- Constrain recovery and registration paths Treat account recovery, additional device enrolment and help-desk resets as part of the authentication boundary, because weak recovery can nullify phishing-resistant sign-in.
- Separate login from approval controls Keep transaction authorization distinct from the sign-in method so that stronger authentication does not break established approval workflows.
Bottom line: Passkey sign-in materially improves phishing resistance in business banking because the credential is tied to the legitimate domain and a trusted device.
Glossary terms: Passkey, Phishing-Resistant Authentication, Public-Key Cryptography, Device-bound Credential
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:07 pm
Passkeys shift the attack surface from shared secrets to device-bound trust. That is a material improvement for business banking because phishing succeeds when the same secret can be replayed elsewhere. Once the credential is tied to the bank’s domain and anchored to a trusted device, the attacker loses the reusable artifact that password theft depends on. The practical implication is that identity teams should judge passkey projects by replay resistance, not by enrollment counts alone.
A question worth separating out:
Q: Why do fallback authentication methods create so much risk after passkey rollout?
A: Fallback methods create risk because attackers target the weakest available route, not the strongest one. If SMS, push, QR fallback, or weak recovery still exists, the attacker can steer the user into that path and defeat the stronger factor indirectly. A passkey deployment is only as resistant as its recovery and fallback design.
👉 Read our full editorial: Passkey sign-in turns business banking login into phishing resistance