Passwords have been a known security problem for decades. What's changed is the urgency. As AI accelerates fraudsters' ability to steal online account credentials, security experts are urging financial institutions to move away from passwords and implement passkey login capabilities before losses escalate.
This post examines the technical and operational challenges the banking sector faces, highlighting the stakes, the standards body driving the shift, and the decision points your team will encounter.
The Challenge
A password is a shared secret. Your customer knows it, and your system stores a verifier for it. This structure is the weakness. Anything that can be typed can be phished, replayed, guessed, or stuffed into a login form from a breached list.
AI changes the economics of this weakness. Faster credential theft means attackers need less skill and time per target. Defenses relying on customers to spot a bad link or choose a strong password are losing ground to automation.
Andrew Shikiar, executive director and CEO of the FIDO Alliance, notes that passwords have been problematic for decades. The FIDO Alliance aims to eliminate passwords altogether. So, the question for a bank isn't whether passwords are a liability. It's how quickly it can retire them without disrupting customer access.
The Environment and Constraints
Banks operate under constraints that most consumer apps don't face.
- Mixed customer base. Some customers use new smartphones with biometrics, while others use shared devices, older hardware, or browsers that lag on standards support.
- Fraud sensitivity. A weak recovery path undoes a strong login. If an attacker can reset a passkey through a call center script, the cryptography is irrelevant.
- User experience risk. Friction at login drives abandonment and support calls. Any change that confuses customers carries a direct cost.
- Regulatory scrutiny. Authentication changes affect audit evidence, risk assessments, and compliance reporting.
As a PAM engineer, you'll recognize this problem. It mirrors privileged access projects: a strong control is easy to specify and hard to roll out across a complex environment.
The Approach: What Passkeys Change Technically
Passkeys are built on FIDO2, the standard for passwordless and phishing-resistant authentication. The technical benefits over passwords include:
No shared secret. The device generates a public/private key pair per account. The bank stores only the public key. A breach of the bank's database yields nothing an attacker can replay.
Origin binding. The authenticator ties the credential to the legitimate relying party domain. A fake banking site can't trigger a valid assertion because the domain won't match. This makes passkeys resistant to phishing.
Nothing to stuff. Credential stuffing depends on reused passwords. A per-site key pair can't be reused across sites.
Local user verification. The biometric or PIN unlocks the private key on the device. It isn't transmitted to the bank.
Compare that to a One-Time Password sent by SMS or generated as a Time-Based One-Time Password. Those add a factor, but a real-time phishing proxy can still relay the code. Passkeys remove the relayable artifact entirely.
A Sensible Rollout Pattern
The goal is a transition that doesn't disrupt customers. Key decision points include:
- Run passkeys alongside passwords first. Offer passkey enrollment at a moment of trust, such as right after a successful authenticated session. Don't force a cutover.
- Prompt, don't mandate. Let customers opt in, and make the passkey prompt the default path once enrolled.
- Harden recovery before retiring passwords. Recovery is the new attack surface. Treat it with the same rigor you'd apply to a break-glass account in a vault.
- Plan for multiple devices. Customers who lose a phone need a defined path back in that doesn't fall back to a weak knowledge-based check.
- Monitor the fallback. Every password login that remains is exposure. Track how many customers still rely on it, and tighten controls on that path as passkey adoption grows.
Results and Metrics
There are no verified deployment figures to report here. However, the direction is clear: security experts are advising financial institutions to implement passkey login capabilities, and the FIDO Alliance exists to eliminate passwords.
When building your business case, define your metrics upfront. Useful ones include the share of active customers enrolled in passkeys, the share of logins completed with a passkey, account takeover attempts against password versus passkey paths, and help-desk contacts tied to login and recovery. Measure your baseline before launch for honest comparisons.
What Would Be Done Differently
Common mistakes are predictable:
- Treating enrollment as the finish line. Enrollment without password retirement leaves the weak path open.
- Ignoring recovery design. Teams often perfect the happy path and leave account recovery as the soft target.
- Underestimating customer messaging. Customers don't know what a passkey is. Clear, short explanations reduce abandonment more than any backend tuning.
- Skipping the fallback inventory. If you don't know which customers can't use passkeys, you can't plan for them.
Takeaways for Your Team
- Passwords are a shared-secret design, and AI-assisted theft widens the gap between attacker speed and customer defenses.
- Passkeys built on FIDO2 remove the shared secret, bind authentication to the legitimate origin, and eliminate the value of stolen password databases.
- The transition succeeds or fails on recovery flows and fallback paths, not on the login screen.
- Run passkeys beside passwords, measure adoption against your baseline, and shrink the password path deliberately.
- Follow the FIDO Alliance's guidance. Its role in shaping authentication standards makes it the reference point for where this industry is heading.
The case for moving is settled. The work left is operational, and it belongs to the engineers who will own the rollout.
