The new alternative to passwords

Money stolen through email and social media hacking in the UK surged to £6.3 million in 2025-26 financial year, up from £1.2 million the year before, according to figures released on 5 October by Report Fraud, the country’s national fraud and cybercrime reporting centre.

In Bangladesh, the available figures tell a different story.

By September 2024, 60,808 women had sought help over cybercrime-related incidents. The most common complaint was doxxing, the unauthorised publication of someone’s private or identifying information, accounting for 41 per cent of the cases. Facebook account hacking made up 18 per cent and blackmail accounted for 17 per cent.

While these figures do not capture the full scale of cybercrime in Bangladesh or the financial losses linked to compromised accounts, they highlight a common reality: once criminals gain control of a digital account, it often becomes the starting point for a chain of further harm.

For decades, passwords have been the primary defence against unauthorised access. One-time passwords (OTPs), delivered by SMS or phone call, were later added as an extra layer of protection. 

Yet cybercriminals have steadily found ways around both.

They trick users into entering credentials on fake websites, exploit passwords reused across multiple services, intercept or persuade victims to disclose OTPs and deploy sophisticated phishing systems that relay login information to legitimate websites in real time.

Even risks such as man-in-the-middle (MITM) attacks and the interception of data in transit remain difficult to eliminate entirely using conventional password-based authentication.

In response, security experts and technology companies are increasingly promoting passkeys as a safer alternative.

Report Fraud recently urged users to adopt passkeys, while tech giants including Google, Apple and Microsoft have integrated them into their ecosystems. Platforms and services such as Meta and Adobe have also introduced passkey-based sign-in options and are actively encouraging users to move away from passwords.

But what exactly is a passkey? How does it work? Is it really more secure? And should you use it?

WHAT IS A PASSKEY?

The FIDO Alliance, which develops authentication standards alongside the World Wide Web Consortium (W3C), describes passkeys as a phishing-resistant alternative to passwords.

Put simply, a passkey is a digital credential that allows you to sign in using a fingerprint, face scan, device PIN or another screen-lock method instead of typing a password.

With a traditional password, you prove your identity by providing a secret that a website can verify. A passkey works differently.

Your phone, tablet or computer stores a unique digital credential linked to both your account and the specific website it was created for. When you sign in, the website asks your device to prove that it holds the correct credential. You then approve the request using your fingerprint, face scan or PIN.

Importantly, your biometric data generally remains on your device. Your fingerprint or face scan is used only to unlock the passkey and is not sent to the website as a login credential.

Think of a passkey as a digital key made exclusively for one website. Your fingerprint or PIN unlocks the key, but neither is the key itself.

HOW DOES A PASSKEY WORK?

Passkeys rely on public-key cryptography, a system that uses two mathematically linked keys instead of a shared secret such as a password.

When a passkey is created, your device generates a pair of keys: a private key and a public key.

The private key remains securely stored on your device or within a trusted credential manager and is never shared with the website. The public key is sent to the website, which uses it to verify future sign-in requests.

A typical sign-in process works like this:

Step 1: The website generates a unique and random challenge, essentially a one-time cryptographic question that an attacker cannot answer simply by copying a previous login response.

Step 2: Your browser and operating system verify which website is requesting authentication and locate the correct passkey. A passkey created for one website generally cannot be used on a fraudulent lookalike site.

Step 3: You confirm your identity using a fingerprint, face scan, device PIN or another approved method. The exact requirement depends on the device and the website's security policy.

Step 4: The device uses the private key to create a cryptographic signature. The private key itself is not sent to the website.

Step 5: The server verifies the response using the public key associated with your account. If everything including signature checks out, access is granted.

The key difference is that you never have to reveal a reusable password, and the website never receives your private key.

IS IT SAFE?

Passkeys are primarily designed to combat phishing, one of the most common ways cybercriminals steal login credentials.

Fraudsters often try to create websites that closely mimic those of banks, social media platforms and other online services. Unsuspecting users enter their usernames, passwords or OTPs, unknowingly handing them directly to criminals.

Passkeys make this far more difficult because they are tied to a specific website. Even if a fake site looks identical to the real one, the passkey created for the legitimate site will generally not work on the fraudulent domain.

They also reduce the risks associated with password leaks. When a website suffers a data breach, stolen passwords are often used to gain access to accounts on other services where users have reused the same credentials. Passkeys eliminate this problem because each credential is unique to a specific website.

However, passkeys are not a cure-all.

They strengthen the authentication process but cannot protect users from every type of fraud, compromised device or poorly designed account recovery system.

Modern devices often store passkeys in dedicated security hardware or isolated environments, such as Apple's Secure Enclave, hardware-backed security systems on Android devices and trusted platform modules (TPMs) on computers. These technologies help shield private keys from many forms of malware and unauthorised access.

Despite these protections, malware or a compromised operating system may still manipulate what users see, trigger unwanted authentication requests or hijack a session after a legitimate login.

Human behaviour also remains a weak point.

Criminals can use social engineering tactics to trick people into approving authentication requests, revealing device PINs or handing over money. A convincing scammer posing as a bank employee, for example, may exploit trust rather than technology.

The level of protection also varies between devices. A well-maintained device with strong security controls will typically provide greater protection than one running outdated software or a compromised operating system.

Not all authentication methods are equal either. The security of a fingerprint reader, facial recognition system or device PIN depends on how it is implemented and the safeguards built into the device.

For this reason, organisations may assess the security characteristics of authenticators before trusting them for sensitive applications. The FIDO Alliance maintains certification and metadata programmes that help organisations evaluate supported authenticators and understand their security capabilities.

Ultimately, passkeys are a significant step forward in online security, particularly in the fight against phishing and credential theft. But stronger authentication alone is not enough. Effective cybersecurity still depends on user awareness, secure device management, well-designed applications and robust fraud-prevention measures.