Authentication does not equal authorization: Are we asking passkeys to prove too much?

Passkeys are gaining traction as a passwordless authentication method, with over 5 billion in use globally. This technology offers enhanced security for the financial industry by eliminating the need for knowledge-based credentials that criminals can exploit. Passkeys also improve user experience by enabling biometric authentication.

However, despite the benefits, account takeovers remain a concern, impacting 6 million US consumers in 2025, with losses surpassing $15 billion. Research indicates that passkeys are failing not due to the technology itself, but due to improper implementation and safeguarding.

Financial institutions must ensure the credibility of passkeys, as securing the front door is only effective if fraudsters cannot manipulate it. Researchers at Palo Alto Networks' Unit 42 demonstrated proof-of-concept attacks against passkey-protected accounts, exploiting malware on compromised devices. However, these scenarios often began with a "poisoned" device, and the attacks did not break passkey cryptography or uncover a "master vault" of credentials.

Despite these findings, the scale of attacks is still likely to be limited, as individualized attacks are harder to scale than widespread breaches.

Recovery of passkeys remains a weak link, especially when relying on email, text, or a PIN. Banks must maintain the original source of trust during account recovery to prevent attackers from using compromised channels. Authentication and authorization are distinct concepts, with passkeys establishing access but authorization determining permission and intent. Ultimately, passkeys are an improvement over traditional password-based systems but should not be expected to solve all security challenges.