The question at hand
Andrew Shikiar's prediction at the Identity & Policy Forum presents a key decision for security architects: should digital wallets replace passwords as your primary authentication method by 2026? With over 4 billion passkeys already in use and major U.S. banks adopting them for sign-ups, the infrastructure for wallet-based authentication is forming. The real question is whether your organization should lead or follow this shift.
This isn't just a technology swap. Digital wallets consolidate identity, credentials, and potentially access policies into a single user-controlled container. This changes your threat model, recovery procedures, and relationship with credential lifecycle management.
The case for digital wallets as primary authentication
Digital wallets address the credential sprawl problem that's plagued IAM teams for years. Instead of managing separate username-password pairs, FIDO2 credentials, and Multi-Factor Cryptographic Devices across numerous applications, you centralize authentication artifacts in a wallet the user controls. This mirrors how passkeys work but extends to include verifiable credentials, payment instruments, and potentially attribute claims.
The phishing-resistant benefits are clear. Digital wallets built on FIDO2 standards eliminate the shared secret problem. There's no password to intercept, no One-Time Password to phish, and no session token to steal. When a user authenticates from their wallet, the cryptographic proof is bound to the specific origin requesting it, preventing replay attacks.
Recovery workflows improve when credentials are in a wallet rather than scattered across identity providers. If a user loses their device, they restore their wallet from backup or a recovery key, regaining all authentication capabilities at once. Compare that to the current state: resetting passwords across multiple applications, re-enrolling authenticators, and waiting for helpdesk tickets to clear.
Integration with verifiable credential frameworks becomes straightforward. Your digital wallet can present proof of employment, security clearance, or training certification without exposing underlying data to the relying party. This is a significant privacy win and reduces the identity data you need to store and protect.
The case for maintaining traditional authentication
Digital wallets introduce a single point of failure that doesn't exist in federated authentication models. If a user's wallet is compromised or locked, they lose access to everything. Traditional IAM architectures allow fallback to alternative methods, secondary email addresses, or administrator-initiated password resets. Wallets make these escape hatches harder to design without compromising security.
The recovery problem is complex. What if the wallet backup fails, the recovery key is lost, and the user's device is destroyed? You need a process that verifies identity strongly enough to issue new credentials without creating a social engineering vector. Many organizations may default to weak recovery mechanisms that attackers can exploit.
Integration with existing IAM infrastructure isn't simple. Your Policy Decision Points, session brokers, and compliance reporting systems expect SAML assertions or OAuth 2.0 tokens from known identity providers. Digital wallets shift that trust boundary. Now you're validating credentials from user-controlled software. Your Policy-Based Access Control rules need to account for wallet-based authentication flows, and your audit logs need to capture enough context to satisfy compliance requirements.
Governance becomes more complex when credentials live outside your administrative domain. You can't revoke a credential stored in a user's wallet the same way you disable an Active Directory account. You need cooperation from the wallet provider or the credential issuer, creating dependencies on external systems and standards that may not mature quickly enough.
Where practitioners actually land
Most security architects aren't choosing between passwords and digital wallets. They're designing hybrid systems that support both while gradually shifting toward wallet-based flows.
The banking sector's adoption of passkeys for sign-ups illustrates this pattern. Banks didn't eliminate passwords overnight. They introduced passkeys as an option, measured adoption rates, and built confidence in recovery workflows before expanding coverage. This is the pragmatic approach when you're responsible for authentication at scale.
Organizations with strong FIDO2 deployments are in the best position to adopt digital wallets early. If you've already solved device enrollment, credential lifecycle management, and Phishing-Resistant Authentication for your workforce, extending that infrastructure to support wallet-based credentials is incremental work. Your Policy Decision Points already validate FIDO2 assertions; wallets just change where those assertions originate.
But if you're still using password-based authentication with Time-Based One-Time Password as your second factor, jumping directly to digital wallets creates too much risk. You need to build foundational capabilities first: credential management, recovery workflows, and integration with your existing session brokers and trust fabric.
Our take
Digital wallets will become a primary authentication method, but not by 2026 for most enterprises. The timeline depends on your current IAM maturity and your tolerance for operational complexity during the transition.
If you've deployed passkeys successfully and your applications support FIDO2, start planning wallet integration now. Build a proof of concept with a low-risk application. Test your recovery procedures with real users. Validate that your compliance reporting captures wallet-based authentication events with enough detail to satisfy auditors.
If you're still dependent on passwords and legacy protocols, focus on FIDO2 adoption first. Wallets are an evolution of that foundation, not a replacement. Get your Policy Decision Points, session management, and Delegated Authorization flows working with phishing-resistant credentials before adding the complexity of wallet-based identity.
The security benefits are real. Wallets eliminate credential phishing, reduce password-related helpdesk costs, and improve the user experience. But those benefits only materialize if your recovery workflows, governance processes, and integration architecture are ready to support them. Rushing into wallet adoption without that foundation creates new risks that outweigh the security gains.
Start with passkeys. Prove you can manage credential lifecycle and recovery at scale. Then extend that capability to digital wallets when the standards mature and your infrastructure is ready.
