Topic starter
16/04/2026 8:26 pm
TL;DR: Passkeys tied to device-bound, origin-verified authentication can stop common account takeover and high-risk action fraud patterns, according to Descope’s analysis. They do not just improve login security, they change what a successful authentication proves and narrow the window for fraudulent action authorization.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “Using Passkeys to Prevent Fraud”.
Key questions
Q: How should security teams use passkeys to reduce account takeover fraud?
A: Use passkeys first on the actions that create the most damage if a session is hijacked.
Q: Why do passwords and OTPs fail to stop account takeover fraud?
A: They prove knowledge of a secret, not presence on a specific registered device.
Q: What breaks when email authentication is not enforced for sensitive workflows?
A: When email authentication is weak, attackers can spoof trusted senders, hijack password resets, and manipulate approvals or payments.
Practitioner guidance
- Map high-risk actions first Identify the endpoints where a valid session can create irreversible loss, such as transfers, reroutes, exports, role changes, or approval workflows.
- Require fresh passkey assertion at the action boundary Trigger a step-up challenge before the sensitive commit, and deny the request unless the backend receives the expected step-up claim.
- Separate login assurance from transaction assurance Keep base authentication lightweight for routine access, but enforce a stricter proof state only when the user crosses into fraud-sensitive activity.
Bottom line: Passkeys reduce fraud by making authentication device-bound and origin-verified, which removes the reusable secret that phishing and replay attacks depend on.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
06/10/2026 6:46 pm
Passkeys close a fraud gap, but they do so by changing the assurance model rather than by solving identity on their own. The key shift is from secret possession to hardware-backed, origin-verified proof at the moment of action. That matters because fraud losses usually happen after login, not at login. Practitioners should stop evaluating authentication controls only by sign-in strength and start measuring whether the actor can still authorise the consequential transaction.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: What should teams do immediately when a passkey-based step-up flow is not available?
A: Treat the action as too risky to inherit the base login state alone. Add a separate proof requirement before the request can commit, and keep the elevated state short-lived. If the application cannot re-check device-bound assurance at the decision point, the safer choice is to slow or block the action until that control exists.
👉 Read our full editorial: Passkeys are closing the fraud gap in high-risk login flows