Passkeys: Secure or Still Vulnerable?

Global passkey adoption has surged, with over 5 billion now in use, significantly reducing reliance on traditional passwords. Despite this advancement, account takeovers remain a critical concern. In 2025, an estimated 6 million US consumers fell victim to such incidents, resulting in over $15 billion in losses.

The effectiveness of passkeys is hampered by implementation flaws, not inherent weaknesses in the technology itself. Researchers have demonstrated how malware on compromised devices can bypass passkey authentication. However, these attacks typically require a "poisoned" device and specific system configurations, making them difficult to scale.

Account recovery presents the most significant vulnerability. If recovery processes revert to less secure methods like email or SMS, they undermine the very security passkeys aim to provide. Financial institutions must prioritize secure, verified recovery methods tied to initial identity verification.

Furthermore, distinguishing between authentication and authorization is crucial. A passkey confirms a user's presence but doesn't inherently verify their intent for sensitive transactions. Financial firms need to implement step-up authentication and contextual checks for high-risk actions to maintain user trust and security.