Financial institutions are investing in deepfake detection tools, training staff to spot synthetic voices, and issuing warnings about AI-generated fraud. But these efforts often miss the mark.
The FIDO Alliance's Identity Policy Forum recently hosted a panel led by the Better Identity Coalition, which, along with the American Bankers Association, examined generative AI threats to financial services digital identity systems. The discussion highlighted a common misconception: organizations treat deepfakes as a detection issue when they're actually an authentication problem.
Here are five myths that keep financial services teams focused on the wrong defenses.
Myth 1: "We need better deepfake detection tools"
Reality: Detection is a losing game. Every improvement in detection triggers an improvement in generation. You're funding an arms race you can't win.
Deepfake detectors look for artifacts like unnatural blinking patterns, audio compression signatures, and lighting inconsistencies. But these artifacts disappear as models improve. The detectors you buy this quarter will struggle against next quarter's generators.
The correct response isn't better detection. It's eliminating the attack vector entirely. If your authentication flow relies on verifying that a voice sounds human or a face looks real, you've already lost. Passkeys remove the need for that verification by binding authentication to cryptographic proof of device possession, not biometric plausibility.
Myth 2: "Passkeys are just for consumer apps"
Reality: Passkeys are a FIDO2 implementation designed specifically for phishing-resistant authentication, which is exactly what financial services need when facing AI-assisted social engineering.
Your consumer banking team might be piloting passkeys for retail customers, but your commercial banking platform still relies on usernames, passwords, and SMS codes. That's where the real exposure lies. A deepfake voice convincing your call center to reset credentials for a treasury account creates more damage than a compromised consumer checking account.
FIDO2 authentication doesn't care if the person on the other end of a video call looks or sounds legitimate. The cryptographic challenge-response happens between the relying party and the authenticator. No amount of synthetic media changes the fact that the attacker doesn't possess the private key.
Myth 3: "Our multi-factor authentication already stops this"
Reality: Your MFA stops credential theft, not credential reset. Deepfakes target the recovery and support processes you built to help legitimate users.
Consider your account recovery flow. A customer calls in, can't access their authenticator app, and needs to reset MFA. Your support agent asks security questions, verifies voice patterns, maybe requests a video call. Every one of those verification points can be synthesized.
Passkeys shift the recovery model. Because the private key never leaves the device and the public key lives with your identity provider, there's no credential to phish and no reset flow to social-engineer. Recovery requires device attestation or a backup passkey, not a convincing performance.
Myth 4: "Implementation will disrupt our existing auth flows"
Reality: Passkey adoption is incremental, not disruptive. You're not overhauling your identity infrastructure; you're adding a phishing-resistant option alongside existing methods.
The FIDO Alliance designed passkeys to work within existing authentication protocols. Your OAuth 2.0 flows don't change. Your session management doesn't change. You add passkey enrollment as an option during account creation or as a step-up authentication method for high-risk transactions.
Start with your highest-risk user segments: treasury managers, wire transfer approvers, account administrators. Let them enroll passkeys as a primary or secondary authentication method. Measure adoption and friction. Expand from there. You don't need a complete overhaul to reduce your exposure to synthetic identity attacks.
Myth 5: "Users won't understand how passkeys work"
Reality: Users don't need to understand the cryptography. They need to understand the gesture: unlock your device, authenticate the request.
You don't explain how Time-Based One-Time Passwords derive from HMAC-SHA1. You tell users to "enter the six-digit code from your app." The same applies to passkeys. The user experience is device unlock (biometric or PIN) followed by confirmation. The WebAuthn ceremony and public key cryptography happen invisibly.
The confusion comes from terminology, not the interaction model. Don't call them "FIDO2 credentials" or "public key authenticators." Call them "device sign-in" or "secure unlock." The gesture is already familiar from unlocking phones and laptops. You're extending it to authentication.
What to do instead
Stop investing in detection theater. Deepfake detectors, voice analysis, and liveness checks are temporary mitigations that degrade as generative models improve. Build authentication flows that don't depend on verifying human authenticity.
Start with a passkey pilot for high-risk transactions. Identify the workflows where synthetic identity attacks would cause the most damage: wire transfers, account modifications, delegation changes. Offer passkey enrollment to users in those workflows. Measure adoption friction and support burden.
Redesign your account recovery processes. Map every recovery path that relies on human verification (security questions, voice confirmation, video calls). Replace them with device-based attestation or backup passkeys. If you can't eliminate human verification entirely, require it in combination with device proof, not as a standalone gate.
Train your support teams to recognize social engineering that targets recovery flows, not just credential theft. The attacker with a deepfake voice isn't trying to guess a password. They're trying to convince your agent to bypass authentication entirely. Your playbook should assume the voice and face are convincing and focus on what the caller can't fake: possession of the registered device.
The financial sector faces sophisticated AI-driven attacks because it processes high-value transactions at scale. Passkeys won't detect deepfakes, but they make deepfakes irrelevant to your authentication flow. That's a better defense than trying to spot the fakes.
