Passkeys Alone Do Not Prove Authorization, TechRadar Reports

The FIDO Alliance estimates that more than 5 billion passkeys are in use worldwide, and more than three-quarters of global consumers have enabled a passkey on at least one account, TechRadar reported. The article said the technology reduces the financial industry’s reliance on reusable secrets that criminals can steal, guess or extract through social engineering, and it speeds up access by allowing customers to use a fingerprint or another biometric instead of navigating multiple screens and entering “memorable information.”

Those gains have not eliminated account takeovers. Javelin research cited by TechRadar found that about 6 million US consumers were affected in 2025, an increase of 18 percent from the previous year, with losses exceeding $15 billion. The Federal Reserve reported a 36 percent increase in account takeovers between 2023 and 2024, the article said, referring only to incidents brought to its attention.

TechRadar argued that the figures do not show passkeys failing outright. A successful passkey authentication establishes control of a device-linked credential, but banks must still determine how that credential was enrolled and whether the session it grants access to remains trustworthy, the article said. That includes whether the account holder genuinely intended to add a payee, recover an account or move a large sum of money. Passkeys are useful, TechRadar said, but they were never designed to answer all of those questions on their own.

Research from Palo Alto Networks’ Unit 42, published in August, described three proof-of-concept attacks against passkey-protected accounts, according to the article. Malware on a compromised device could authenticate without the account holder present, interfere with the registration of a new passkey or expose passkeys synchronized to that user’s environment.

TechRadar cautioned that each scenario began with a poisoned device where malware was already present, and the most serious cases depended on a particular combination of browsers and operating systems with preset security hardware. None of the cases broke the cryptography behind passkeys or uncovered a master vault of credentials that could be raided in a single attack, the article said, making such attacks harder to scale than mass breaches. It added that scale is not a sufficient defense in finance, because one high-value account can justify the effort and a single breach can damage a bank’s reputation or regulatory standing.

Account recovery remains the weakest link, according to the article. When users lose or switch devices, issuing a new passkey is not like resetting a password; it is only as trustworthy as the process used to issue it. If recovery falls back on email, a text message or a PIN, an attacker only needs to clear that weaker hurdle. A financial institution then has to know whether the person claiming a new device is legitimate or an attacker who obtained that information by chance or through targeting. That would return passkeys to basic knowledge-based security and undermine their purpose, TechRadar said.

Editor's Summary

The article reports that passkey adoption is rising alongside account takeovers, and it argues that the weakness lies in enrollment, session trust and account recovery rather than in the cryptography itself. It cites proof-of-concept attacks that require compromised devices or specific configurations, while warning that a single high-value breach can still matter in finance.