As new forms of artificial intelligence speed up fraudsters’ ability to steal online account credentials, security experts are advising financial institutions to move away from passwords and implement passkey login capabilities to prevent future losses.
Passwords have been seen as problematic by online security experts for decades, says Andrew Shikiar, executive director and CEO of the FIDO Alliance, a global organization of technology providers created to eliminate passwords altogether.
First of all, they’re easy to steal.
“That credential is stolen most frequently through some sort of social engineering or phishing attack where someone is duped into handing over their credential,” Shikiar says. “So, whether that is clicking on a link to reset their password on a site, which is fake, or being told to hand over the credential through some other trick, credential phishing is the number one threat out there — and that is growing in volume and sophistication with AI.”
That leads to account takeover, which ultimately allows the fraudster to steal money. The Federal Bureau of Investigation (FBI) Internet Crimes Report 2025 shows there were more than twice as many complaints of phishing or spoofing incidents reported to the Internet Crime Complaint Center last year than the second-most reported type of internet crime. There were also 4,700 complaints of account takeovers leading to nearly $360 million in losses.
But Shikiar says passwords also leave bank and credit union customers and members vulnerable even if they never get a phishing email. Many are stolen through malware and put up for sale on the dark web. A 2025 study from the cybersecurity company Deep Strike found two billion credentials on dark web lists that included email and password pairings.
Even with multifactor authentication (MFA) methods that send one-time passcodes or prompts that must be entered or approved to finish logging in, a fraudster that already has a username and password can often still find ways to persuade a customer to approve those, or use malware to read the codes.
Brian Russell, a consultant who previously led digital identity and authentication efforts for both Wells Fargo & Company and U.S. Bancorp, says fraudsters who obtain such information can launch something called credential stuffing attacks at greater speeds than ever before, thanks to AI. “When they do mass attacks, bots that have hundreds of thousands of usernames and passwords keep cycling through [to log in],” he says. “The more IDs and passwords you eliminate, the less that are on the dark web. So, there’s less for the fraudsters to use to get in.”
Passkeys Are More Secure
Launched in 2013, the FIDO Alliance immediately got to work creating a new method for sign-in that didn’t include passwords. Working in partnership with the Worldwide Web Consortium, they ultimately created passkey technology. They also established an open authentication standard called FIDO2. All passkeys are built to FIDO2 specifications and are now recognized as the global standard for account login security.
Shikiar says to think of a passkey as having both a lock and key. “The website has the lock, and only you have the key. Only you can sign in with that key, and you prove that you have the key by verifying yourself to your device,” he says. “If you’re using a phone or most modern devices, it’s biometric. So, I use my face ID on my iPhone to verify that it is me in possession of my device. That allows the key, which is on my device, to then go over the web in a cryptographic way, go to that lock and unlock access to that site.”
Because a fraudster can’t access that key, they also have no way to log into a customer’s account. And if they try to persuade that same customer to sign into a fake website, the passkey automatically recognizes the site as illegitimate and won’t authenticate the login.
In recent years, passkeys have been modified to allow people to sign into multiple devices. That means if the original passkey was created on an iPhone, you can still use it to open the same account on your computer. Shikiar says that is now possible because all of the major web platform providers and device manufacturers are part of the FIDO Alliance. “iCloud is a good example, or Google Cloud,” he says. “It’s basically allowing this key to be securely stored across an operating system cloud or device cloud. And these clouds have very, very stringent security requirements.”
Passkeys in Banking
Many of the largest banks have implemented passkey security within the last few years. But they actually trailed behind a core provider that made the capability available to its client banks and credit unions in 2024. Jack Henry & Associates set up passkeys as a default customer option on its Banno digital banking platform, which is used by more than 1,000 banks and credit unions.
Chad Killingsworth, Jack Henry’s head of engineering, started developing those passkey specifications all the way back in 2020. “Because we work in online banking and because of the sheer amount of attacks that we see on a platform the size of ours, and the actual fraud scenarios and account takeover scenarios we see from our member institutions, we have long looked for ways that we can push [financial institutions] and their users to a more secure profile,” he says. “We’ve always done it by default because really there’s no reason not to. This is better security in every way.”
Lumin Digital also provides passkey optionality to its client financial institutions, while Q2 has completed development of its passkey functionality and is in the go-to-market phase. Russell says that is a positive trend, because the technology is too complicated for community banks and credit unions to implement on their own.
While passkey optionality is becoming more widespread, Killingsworth says there are several reasons passwords aren’t going away anytime soon. “What happens if you lose the phone that it was on, and you need to do an account recovery? What do you fall back to?” he asks. “Let’s say you want to hook up to Quicken or QuickBooks. Some of those systems only work on username and passwords still.” Killingsworth also points out that call center employees typically employ usernames and passwords to help customers or members with account issues as well.
Shikiar says new forms of technology like digital identification are being worked on to ultimately alleviate those issues, but he acknowledges it would be difficult for banks and credit unions to completely abandon passwords in the short term. “I understand the concern there,” he says. “Minimize password use and make it as anomalous and as much of an outlier as possible.”
Russell points out that while passkeys effectively eliminate the possibility of account takeovers, they can’t stop every form of fraud. “So, when a fraudster uses AI to convince you that Taylor Swift wants to marry you, and they’re going to [have you] send all this money, as absurd as it seems, it doesn’t block that.”
Since banks and credit unions have had to address a wide variety of fraud and scams, and because they are more cautious in nature than online retailers or other businesses, they have been somewhat slower to adopt and implement passkeys. “This is a new thing,” Shikiar says. “The last thing you ever want to do is lock someone out of their bank account. So, they’ll naturally be cautious. I think banks were a little bit behind, but catching up.”
Previous