If your bank app has started nudging you to “set up a passkey” every time you log in, you’re not imagining it. Chase, Bank of America, PayPal, and a growing list of fintech apps have all rolled this out over the past year or so. It’s not a gimmick, and it’s not just another password manager feature. It’s a different way of proving you are who you say you are, and banks are betting on it hard.
So what are passkeys, actually? And should you bother setting one up the next time your bank asks?
What Are Passkeys, in Plain English
A passkey is a digital credential that replaces your password entirely. Instead of typing a string of characters you have to remember, you unlock your account with the same fingerprint scan, face scan, or device PIN you already use to unlock your phone or laptop.
Under the hood, passkeys rely on something called public-key cryptography. When you create a passkey for a site, your device generates two mathematically linked keys: a private key that never leaves your device, and a public key that gets stored on the website’s server. When you log in, your device proves it has the private key without ever sending it anywhere. There’s no password sitting on a server for a hacker to steal, because there is no password.
The technology comes from a group called the FIDO Alliance (Fast Identity Online), which includes Apple, Google, Microsoft, and most major banks. According to FIDO’s own numbers, roughly 5 billion passkeys were in active use worldwide as of World Passkey Day in May 2026, and about 75% of consumers say they’ve turned on at least one. That’s a fast climb for something most people had never heard of a few years ago.
Why Phishing Doesn’t Work on Passkeys
Here’s the part that actually matters to your bank account: passkeys are phishing resistant by design.
With a password, you can be tricked. A fake login page that looks just like your bank’s site can capture your username and password the moment you type them in, and the scammer now has everything they need. This is still one of the most common ways people lose access to financial accounts, and it works because a password is just text. It doesn’t know or care where it’s being typed.
A passkey is different. It’s cryptographically tied to the real website’s exact domain. If a scammer sets up a lookalike page at “yourbank-secure-login.com” instead of the real “yourbank.com,” your device simply won’t offer up the passkey. It’s not that you have to remember not to fall for it. The technology physically can’t be used on the wrong site. That single fact is why banks, which lose real money to phishing every year, are pushing so hard.
It also kills two other common attack patterns: password reuse (there’s no password to reuse across sites) and large-scale credential leaks (a breached database of passkeys is useless to an attacker, since the private keys were never stored there in the first place).
How Passkeys Actually Work When You Log In
The process is simpler than the cryptography behind it sounds. Here’s roughly what happens:
- You visit your bank’s app or website and tap “log in.”
- Your device (phone, laptop, or tablet) recognizes it has a passkey saved for that site and prompts you for your fingerprint, face scan, or PIN.
- Your device uses the private key to answer a challenge from the bank’s server, proving it’s really you, without ever transmitting the key itself.
- You’re in. No typing, no “forgot password” link, no six-digit code texted to your phone.
Most passkeys sync across your devices through your phone’s ecosystem (iCloud Keychain for Apple devices, Google Password Manager for Android, or a third-party password manager that supports passkeys). That means if you set one up on your phone, it can often show up on your laptop too, as long as they’re linked to the same account.
Passkeys vs. Passwords: A Quick Comparison
| Passwords | Passkeys | |
|---|---|---|
| What you remember | A string of characters (or nothing, if reused) | Nothing; your device handles it |
| Vulnerable to phishing | Yes, easily | No, tied to the real domain |
| Vulnerable to data breaches | Yes, if stored insecurely | Largely no, private key never leaves your device |
| Works across sites without reuse | Only with a password manager | Yes, by design |
| Setup effort | Low | Slightly higher the first time |
| What happens if you lose your device | You still have the password | Depends on backup and recovery setup, see below |
What Happens If You Lose Your Phone
This is the question almost everyone asks first, and it’s a fair one. If your passkey lives on your phone, doesn’t losing your phone mean losing access to your bank?
Not necessarily, but it does depend on how you set things up. A few things soften the risk:
- Cloud backup. If your passkeys sync through iCloud Keychain, Google Password Manager, or a cross-platform manager, you can typically recover them on a new device once you sign back into that ecosystem account.
- Multiple devices. Many people end up with a passkey saved on both a phone and a laptop, so losing one device doesn’t lock you out.
- Bank-side recovery. Banks still maintain account-recovery paths (identity verification, backup codes, or a fallback to your old login method) precisely because they know devices get lost, stolen, or replaced.
The honest caveat here: recovery can be tricky, and it varies by bank and by which passkey provider you use. It’s worth checking your bank’s specific recovery process before you’re in an emergency, not during one. And if a device with your passkey is lost or stolen, most implementations still require the finder to unlock the device itself (fingerprint, face, or PIN) before the passkey does anything, which is a meaningful backstop.
Not Every Site Supports Passkeys Yet, and That’s Okay
Passkey adoption isn’t universal. According to 2026 industry benchmarks from MojoAuth, fintech companies are adopting passkeys fastest, at around 60% of surveyed platforms, compared to roughly 35% for e-commerce sites. That gap makes sense: banks have the most to lose from phishing and account takeover, so they have the strongest incentive to move first.
That means you’ll likely see passkeys rolled out at your bank before you see them everywhere else. For now, it’s normal to have a mix: passkeys for your bank and a few major tech accounts, and passwords (ideally strong, unique ones stored in a password manager) for everything else. You can usually still use your old password as a fallback even after setting up a passkey, since most banks keep both options live during the transition.
Should You Actually Set One Up?
If your bank offers it, yes, it’s worth doing. The setup takes a couple of minutes, it removes the single biggest way people get phished out of their accounts, and it doesn’t cost you anything. That said, a passkey isn’t a replacement for basic account hygiene. You should still:
- Keep your phone’s lock screen protected with a strong PIN or biometric lock, since that’s now the gateway to your passkeys.
- Review your bank’s account-recovery options before you need them.
- Stay alert for scam calls or texts asking you to “verify” your passkey or share a code. No legitimate passkey process ever asks you to read anything out loud to another person.
Passkeys are a genuine security upgrade, not marketing dressed up as one. They may not fully replace passwords for years, since some services move slower than others, but the direction is clear, and it’s happening because it measurably reduces fraud, not because it’s trendy.
A Quick Note on Financial Safety
This article is for general information only. It doesn’t cover every bank’s specific implementation, and passkey recovery processes can vary. Always check your own financial institution’s official help pages before changing how you log in, and never share a passkey prompt, one-time code, or recovery link with anyone who contacts you first. For broader guidance on phishing and account security, the FIDO Alliance, the Cybersecurity and Infrastructure Security Agency (CISA), and the Federal Trade Commission (FTC) all publish consumer-facing resources.
For related reading on keeping your financial accounts safe, see our guides on whether digital wallets are safer than physical cards, how to freeze your credit at all three bureaus, and common payment app mistakes that could cost you money.
Frequently Asked Questions
What is an example of a passkey?
A passkey is created the first time you enable it for an account, usually inside your phone’s settings or directly in an app like your bank’s. In practice, it looks like a prompt: instead of a password field, you see a request for your fingerprint, face scan, or device PIN. There’s no code to write down or memorize, which is part of the point.
What are the downsides of passkeys?
The main tradeoffs are around device dependence and support gaps. If someone has access to your unlocked device, they may be able to authenticate as you, since the device itself becomes the trust anchor. Account recovery after losing a device can also be tricky and varies by provider. And not every website or app supports passkeys yet, so you’ll likely be juggling both passkeys and passwords for a while.
Are passkeys safer than passwords?
Generally, yes. Passkeys remove two of the biggest risks tied to passwords: phishing (since a passkey only works on the real, matching website) and data breaches (since there’s no password stored on a server to steal). They’re not a complete substitute for good device security, but for phishing resistance specifically, they’re a meaningful step up.
Can I still use a password if I have a passkey?
In most cases, yes. Banks and other services that have rolled out passkeys typically keep the password option available as a fallback during the transition, rather than removing it outright. Over time, more services may nudge users toward passkey-only login, but that shift is happening gradually, not all at once.
How do I set up a passkey for my bank account?
Check your bank’s app or website for a security or login settings section, often labeled something like “passkey,” “biometric login,” or “passwordless sign-in.” The setup usually takes under two minutes and prompts you to confirm with your device’s fingerprint, face scan, or PIN. If you don’t see the option yet, your bank may simply not have rolled it out, since adoption is still uneven across the industry.
