Passkeys in UK financial services: why the case is now made

For more than a decade the standard fix for weak passwords in UK banking has been a code sent by text message. That fix is wearing out. In 2026 the NCSC said passkeys should be the default way consumers sign in, and government rolled them out to more than 23 million people. For UK financial services, the question is no longer whether, but how fast.

What a passkey is

A passkey is a login credential built on the FIDO2 standards. Instead of a shared secret that the customer types in, the customer’s device holds a private key and proves it has it by signing a challenge from your service. The customer unlocks it with a fingerprint, face scan or device PIN, the same way they unlock their phone.

• Nothing reusable crosses the network. There is no password database to breach and no code to replay.
• Each passkey is bound to the genuine domain or app it was created for. A look-alike site cannot request it, however convincing it looks.

Where the login requires the biometric or PIN step, the NCSC confirms that a FIDO2 login counts as multi-factor authentication.

What changed in 2026

• The NCSC’s position hardened. Its April 2026 technical assessment found that “all traditional MFA methods… are inherently phishable” and that passkeys offer stronger protection than the best-implemented traditional MFA.
• Government went first at scale. After a trial with over 300,000 people, GOV.UK One Login offered passkeys to more than 23 million users. Passkey sign-ins are up to eight times faster than a password plus two-step verification.
• Customers are already enrolled elsewhere. More than half of active UK Google users have registered a passkey.

The result is an awkward comparison. A UK customer can now sign in to their tax account with a phishing-resistant credential, then sign in to their bank with a password and a text message. Customers will notice that gap. So will the press after the next account takeover story, and so will supervisors.

Why financial services should care more than most

The fraud numbers point at authentication

UK Finance records £1.28 billion stolen through payment fraud in 2025, with unauthorised fraud cases up 11% to 3.81 million. It specifically notes criminals compromising one-time passcodes to register digital wallets and make fraudulent transactions. Remote banking fraud losses fell 27% to £104.4 million, but case volumes rose 11%: controls are holding while attempts keep climbing.

Account takeover and SIM swaps

Cifas recorded more than 78,000 account takeover cases in 2025, up 6%, with SIM swaps up 38%. A SIM swap turns an SMS code into a gift to the attacker. A passkey on the customer’s device does not move with the phone number.

Unauthorised losses usually land on the firm

Under the Payment Services Regulations 2017, the provider must generally refund an unauthorised payment. The customer bears the loss only in limited cases such as fraud or gross negligence. Authentication strength is one of the few controls that acts directly on that line.

Consumer Duty raises the bar for “reasonable”

The Consumer Duty requires firms to avoid causing foreseeable harm. Nothing in it mandates passkeys. But once the national technical authority has published that code-based MFA is phishable and a stronger option is widely available, harm from phished codes is harder to call unforeseeable. In our view, that shifts what a reasonable control set looks like.

The same logic applies to your own staff

Phishing remains the most common and most disruptive breach type reported by UK businesses (DSIT). Payment approvers, administrators, the service desk and anyone with remote access are the accounts attackers want.

Regulation: permitted, not yet mandated

Document how your implementation maps to the SCA elements, particularly for synced passkeys, and have compliance sign off the analysis. The FCA also expects SCA to work for all groups of consumers, including methods that do not rely on a mobile phone. Make passkeys the primary route, not the only one: hardware security keys and card readers remain valid options.

Where passkey rollouts go wrong

A practical rollout sequence

Four questions for your next board or ExCo

Where do you stand?

Phishing-resistant MFA for privileged staff and payment approvers is a Level 3 (Managed) capability. Customer passkeys with measured outcomes is Level 4 (Measured). Passkeys by default, with hardened recovery and weaker fallbacks retired, is Level 5 (Optimised). A firm with strong fraud analytics but code-based MFA at the front door is often further back on authentication than its overall posture suggests.

A TrustOps Framework Assessment maps your controls against the model and gives your board a costed, sequenced plan. Or start with the free 15-minute assessment.

General information, current as of September 2026. Not legal or regulated compliance advice. Verify against current primary sources.