Passkey authentication is gaining momentum as Apple, Google, and Microsoft expand their support for FIDO-based authentication across devices and operating systems. By reducing reliance on traditional passwords, passkeys could provide organizations with a more secure authentication method while also making it easier for consumers to verify their identities.
New capabilities could make passkeys even more practical by allowing credentials to synchronize across a user’s devices and enabling authentication to move between computers and mobile phones. Combined with technologies such as behavioral biometrics and risk-based authentication, these developments could help financial institutions strengthen security without introducing unnecessary friction into the customer experience.
We highlighted the Apple, Google and Microsoft adoption of PassKey using FIDO and Bluetooth earlier this week. Entersekt indicates that these providers will now offer two new techniques to make these Passkeys more widely adopted:
- Synchronize PassKey between all your devices from each vendor (e.g. Mac OS with iPhone)
- Utilize BLE technology to transfer authentication from a PC to a Mobile phone (a protocol called CaBLE or Cloud assisted BLE)
These techniques are all being tested in various Betas and Technology previews by these vendors in their browser and operating systems.
Testing Passkeys Across Devices and Platforms
In fact, Entersekt has already successfully validated the following experiences:
- You can use FIDO keys created on your MAC OS on your iPhone as well, as they are synchronized.
- You can pair your Android or iOS device with Chrome on a Windows or Mac PC. This is used by scanning a QR code on your PC with your mobile device. The mobile Operating System natively recognizes this QR, which in turn creates the PassKey link. This utilizes BLE to ensure the devices are in proximity with each other.
Given support in every major operating system deployed today, including Google Chrome, that is based on an Open Standard known as FIDO, this is the authentication mechanism every device will soon be supporting and so you should get an early head start.
Combining Passkeys With Risk-Based Authentication
Overall these are some of the key building blocks to position your organization to be ready for the future of authentication. The Entersekt solution also utilizes Mastercard’s NuData behavioral biometrics and supports 3D Secure.
“By implementing Entersekt’s EMV 3-D Secure solution, Capitec can now identify high-risk e-commerce interactions in real-time, significantly boosting security without impacting the customer experience. The solution is available as a single platform and comes pre-integrated with NuDetect, NuData Security’s flagship product. It combines behavioral biometrics, machine learning, and insights from billions of anonymous data points to distinguish between authentic users and potential fraudsters based on their online, mobile app, and smartphone interactions, flagging those that represent the highest risk.
During checkout, the solution derives a risk score for the cardholder’s e-commerce transaction. Based on the risk score, a frictionless authentication experience continues when there’s little to no risk. In high-risk cases, where greater certainty is required, a step-up authentication process is triggered. The solution supports a range of authentication options, including in-app push prompts, biometrics, and FIDO-certified security keys.”
The growing support for passkey authentication across major technology platforms could make FIDO-based authentication considerably easier for consumers and businesses to adopt. Synchronization between devices and the ability to authenticate across computers and smartphones address some of the practical challenges that can otherwise limit the usefulness of stronger authentication methods.
For financial institutions, the opportunity extends beyond replacing passwords. Passkeys can become part of a broader security strategy that incorporates behavioral biometrics, transaction risk analysis, and step-up authentication when additional verification is necessary.
The goal is to apply stronger security without making every customer complete additional authentication steps. By combining passkey authentication with technologies that identify higher-risk activity in real time, financial institutions can introduce friction when it is warranted while allowing lower-risk transactions to proceed more seamlessly. As support expands across devices and operating systems, organizations should begin considering how these technologies fit into their future authentication strategies.
Overview by Tim Sloane, VP, Payments Innovation at Mercator Advisory Group
