Passkeys and Payments: Can Phishing-Resistant Login Fix Checkout Authentication?

Payment authentication has spent a decade patching around one root cause: shared secrets. Passwords can be phished, reused, and stuffed; SMS codes can be intercepted or socially engineered; even one-time passcodes fail the moment a convincing fake page asks for them. Our archive documents the consequences — account takeover at scale, SIM-swap hijacks of SMS codes. Passkeys attack the root cause instead of the symptoms: they replace the shared secret with public-key cryptography, so there is nothing to phish, reuse, or intercept. The payment industry has noticed — passkeys are moving from login feature to checkout infrastructure, appearing in wallets, Click to Pay, and 3-D Secure flows. This guide explains how they work, where they genuinely fit in payments, and what they still don’t solve.

Quick answer: A passkey is a FIDO2/WebAuthn credential: a cryptographic key pair where the private key stays on the user’s device (unlocked by biometric or device PIN) and the site holds only the public key. Authentication signs a site-specific challenge, so credentials cannot be phished, replayed, or stolen from a server database. In payments, passkeys strengthen account login, wallet authorization, and 3-D Secure verification — and can satisfy strong customer authentication requirements.

How do passkeys actually work?

Three properties do all the security work:

1. Nothing shared, nothing to steal. At registration, the device generates a key pair; the service stores the public half. A breach of the service’s credential database yields public keys — useless for impersonation. Contrast the password world, where every server breach is a credential-stuffing arsenal.
2. Origin binding kills phishing. The credential is bound to the legitimate site’s identity, and the browser or OS will only exercise it for that origin. A pixel-perfect fake checkout page cannot request the real site’s passkey — the platform simply won’t offer it. This is the property no OTP scheme has: users cannot be tricked into “typing the passkey” into a fraudulent page, because there is nothing to type.
3. Local user verification. The private key unlocks with the device’s biometric or PIN. Note the precision: the biometric never leaves the device and is never sent to the merchant — it merely authorizes the local signature, the same architecture we described in biometric authentication in mobile wallets.

Synced vs. device-bound passkeys

Consumer passkeys typically sync across a user’s devices through their platform account — solving the “I lost my phone” problem that killed earlier hardware-token schemes, at the cost of making the platform account’s security part of the trust chain. Device-bound passkeys (including hardware security keys) never leave one authenticator: stronger assurance, harsher recovery. Payments leans toward synced for consumers — usability wins adoption, and adoption is the security feature — with device-bound reserved for high-assurance roles like administrative access to payment systems.

Where do passkeys fit in payment flows?

• Account and wallet login. The straightforward win: a passkey-protected merchant or wallet account is immune to the credential-stuffing and phishing paths that feed most account-takeover fraud. Every stored card behind a passkey login is a card that stolen-password lists can no longer reach.
• 3-D Secure step-up. The clumsiest moment in online payments — the issuer challenge — is being rebuilt around FIDO. Instead of an SMS code (phishable, SIM-swappable), the challenge resolves with a biometric prompt signed by a passkey the issuer or wallet registered. EMV 3DS supports carrying such authentication results, and card-network programs are actively rolling passkey verification into 3-D Secure flows and Click to Pay checkout. Faster than typing a code, and resistant to the interception attacks that plague SMS.
• Strong customer authentication. Under PSD2-style rules, a passkey elegantly bundles two factors in one gesture: possession (the device holding the private key) plus inherence or knowledge (the biometric or PIN that unlocks it). Regulators and issuers have accepted well-implemented FIDO authentication as meeting SCA’s two-factor logic — one reason European issuers moved early.
• Guest-flow recognition. Network wallet initiatives use passkeys to let a returning shopper authenticate to their stored credentials on any merchant — no password, no OTP — which is the quiet foundation under modern Click to Pay experiences.

What passkeys do not fix

Vendor-neutral honesty, in list form:

1. Authorized-fraud scams. A victim manipulated into willingly paying a fraudster authenticates flawlessly with their passkey. The entire class of authorized push payment fraud passes straight through — authentication proves who acted, not whether they were deceived.
2. Recovery-flow attacks. When the passkey is unphishable, attackers phish the fallback: “reset via email,” help-desk social engineering, or new-device enrollment. An account whose recovery path is a password reset link is a password-secured account wearing a passkey costume. Recovery design — cooldowns, multi-signal verification, notification of enrollments — is now the perimeter.
3. Compromised devices. Malware on the user’s device operates after authentication succeeds. Session hijacking and remote-access scams survive the passkey transition.
4. Enrollment fraud. Registering a passkey on a fraudster’s device against a stolen or synthetic identity locks the attacker in securely. Identity proofing at enrollment matters more, not less — the lesson synthetic-identity fraud keeps teaching.
5. The stolen-card baseline. Passkeys authenticate accounts and cardholders; a fresh stolen card number used at a guest checkout with no authentication requirement is untouched. Passkeys shrink specific fraud channels; they are not a fraud program.

Adoption guidance by audience

• Merchants: offer passkey login for accounts holding stored credentials; measure ATO-driven fraud and support-ticket volume before and after — the case usually makes itself. Keep passwordless and password paths only as long as migration requires, and harden recovery first.
• Issuers and PSPs: the highest-leverage deployment is replacing SMS OTP in step-up flows; every SMS eliminated removes a SIM-swap and phishing surface while cutting challenge friction — the rare control that improves security and conversion together.
• Developers: WebAuthn is a browser standard, not a vendor product; platform and library support is mature. Budget the real work for account lifecycle — enrollment, multiple credentials per user, revocation, recovery — not the ceremony itself.
• Consumers: enroll passkeys where offered, especially on wallet, bank, and email accounts (email being the recovery skeleton key for everything else), and treat any request to disable or “re-verify” a passkey via a link or call as the scam it is.

Frequently asked questions

Are passkeys the same as biometric payments?

No. The biometric only unlocks the local private key; what the merchant or issuer receives is a cryptographic signature. No fingerprint or face data is transmitted or stored server-side.

What happens if I lose all my devices?

Synced passkeys restore through your platform account on a new device — which is why that account’s own security and recovery process is worth genuine care. Services should also support registering multiple passkeys as mutual backups.

Can passkeys be stolen in a data breach?

Server-side breaches expose only public keys. Client-side, the private key sits in the device’s secure hardware or protected keystore; large-scale remote theft of passkeys has no equivalent to a password-dump economy.

Do passkeys satisfy PSD2 SCA?

Properly implemented FIDO authentication combining device possession with user verification is widely accepted as meeting SCA’s two-factor requirement — confirm specifics with your issuer or regulator guidance for your flow, particularly around dynamic linking for payment amounts.

Will passkeys replace 3-D Secure?

They are becoming 3-D Secure’s better verification method rather than its replacement: the 3DS rails carry risk data and liability rules; passkeys upgrade the moment of proof inside them.

The pattern across modern payment security is consistent: stop transmitting secrets, start proving possession cryptographically. EMV did it for cards, tokenization did it for stored credentials — passkeys do it for the human at the keyboard. The fraud that remains will concentrate exactly where proof can’t reach: persuasion.