For years, the six-digit code texted to your phone was the standard "extra step" for logging in to a bank. It helped — but criminals learned to steal those codes by tricking people, hijacking phone numbers, and building fake login pages. Passkeys are designed to close those gaps, and regulators in several countries are now pushing banks away from text-message codes.
Last updated September 17, 2026.
Key takeaways
- A passkey is a sign-in credential based on public-key cryptography, stored on your device or in a password manager and unlocked with your fingerprint, face, or device PIN [1].
- Passkeys are phishing-resistant: they only work on the genuine website or app they were created for, so a fake bank site can't capture one [1][2].
- SMS codes can be stolen through phishing, social engineering, and SIM swaps (a criminal moving your number to their SIM). U.S. cybersecurity agencies have advised against relying on SMS for multi-factor authentication where better options exist [3].
- Regulators are acting: the UAE's central bank set a March 31, 2026 deadline to phase out SMS and email one-time passwords (OTPs), and India's central bank required a new authentication framework allowing alternatives to SMS OTP from April 1, 2026 [4][5].
- Support varies by bank. Check your bank's security settings, and keep a backup sign-in method.
First, some definitions
- Authentication: proving you are who you say you are when signing in or approving a payment.
- Multi-factor authentication (MFA): using two or more different kinds of proof — something you know (password), something you have (phone, security key), something you are (fingerprint).
- One-time password (OTP): a short code valid for a single use, sent by SMS or email or generated by an authenticator app.
- Phishing: tricking you into entering credentials on a fake site or revealing them to a scammer.
Why SMS codes fall short
Text-message codes block many automated attacks, which is why they became popular. But they have three structural weaknesses:
- They can be phished in real time. A fake login page asks for your password and then your code, and the criminal immediately enters both on the real site. Scammers also call pretending to be the bank and ask you to "read back the code we just sent."
- Your phone number can be hijacked. In a SIM swap, a criminal convinces or bribes a mobile carrier employee to move your number to a new SIM. Port-out fraud moves your number to another carrier. Either way, your codes go to them. In November 2023, the FCC adopted rules requiring wireless carriers to use secure methods to authenticate customers before SIM changes and port-outs, and to notify customers of those requests [6].
- SMS isn't encrypted end to end. Following intrusions into telecommunications networks by China-linked threat actors, CISA published mobile communications best-practice guidance urging highly targeted individuals to review how they communicate and secure accounts [3].
How passkeys work (plain English)
A passkey uses a key pair:
- A private key stays on your device or in your synced password manager. It never gets sent to the bank.
- A public key is stored by the bank. It's useless to a thief on its own.
When you sign in, the bank sends a challenge. Your device asks you to unlock it with your face, fingerprint, or PIN, then uses the private key to sign the challenge. The bank checks the signature with the public key. Nothing reusable — no password, no code — travels across the internet.
Crucially, passkeys are bound to the website or app domain that created them. If you land on "yourbank-secure-login.com," your device simply has no passkey for that site, so there's nothing to steal [1][2].
Passkeys are built on open standards from the FIDO Alliance and the World Wide Web Consortium (WebAuthn) and are supported by major operating systems and browsers [1][7].
Synced vs. device-bound passkeys
| Type | Where it lives | Pros | Trade-offs |
|---|---|---|---|
| Synced passkey | Encrypted in a cloud-synced credential manager (e.g., from Apple, Google, Microsoft, or a third-party password manager) | Survives losing a phone; works across your devices | Security depends on the credential manager account |
| Device-bound passkey | A single device or hardware security key | Highest assurance; can't be copied | Lose the device, lose the credential — need a backup |
The U.S. National Institute of Standards and Technology's updated digital identity guidelines (SP 800-63B-4, finalized August 26, 2025) permit syncable authenticators at its middle assurance level (AAL2) but not its highest (AAL3), which requires non-exportable keys. The same guidelines require services at AAL2 to offer at least one phishing-resistant option and classify SMS and voice-call codes as a "restricted" authenticator [8]. These guidelines are written for U.S. federal agencies, but many private companies use them as a benchmark.
Comparing common sign-in methods
| Method | Phishing-resistant? | SIM-swap risk? | Convenience |
|---|---|---|---|
| Password only | No | N/A | Easy but weak |
| Password + SMS code | No | Yes | Familiar |
| Password + email code | No | No, but email account can be compromised | Moderate |
| Authenticator app code (TOTP) | No — codes can be phished in real time | No | Moderate |
| Push notification approval | Partially; vulnerable to "MFA fatigue" and social engineering | No | Easy |
| Passkey | Yes [1] | No | Easy once set up |
| Hardware security key (FIDO) | Yes | No | Requires carrying a key |
What regulators around the world are doing
The shift isn't only about technology companies; financial regulators are acting too.
- United Arab Emirates: A 2025 Central Bank of the UAE notice (CBUAE/FCMCP/2025/3057) directed licensed financial institutions to phase out SMS and email OTPs in favor of alternatives such as in-app authentication, biometrics, and passkeys, starting in July 2025, with a final deadline of March 31, 2026 [4][10]. We did not find a Central Bank statement confirming that the phase-out was complete.
- India: The Reserve Bank of India's Authentication Mechanisms for Digital Payment Transactions Directions, 2025, issued September 25, 2025, require two authentication factors — at least one dynamically generated or provable — while opening the door to alternatives to SMS OTP such as biometrics. Compliance was required by April 1, 2026, with risk-based checks for cross-border online card transactions due by October 1, 2026 [5][11].
- United States: There is no general federal mandate for banks to drop SMS codes. The FFIEC's August 2021 authentication guidance supports layered security and risk-based controls and highlights weaknesses in single-factor authentication [9].
- EU and UK: Strong customer authentication rules require multi-factor authentication for many online payments but don't mandate a specific method.
Separately, major tech platforms support passkeys for their own accounts, which has made the technology familiar to many consumers.
Why aren't passkeys everywhere yet?
- Legacy systems. Banks run older authentication stacks and phone channels that can't use passkeys directly.
- Account recovery. If you lose all your devices, the bank still needs a way to let you back in — and recovery flows are often where SMS persists and where attackers aim.
- Customer support and accessibility. Not every customer has a modern smartphone.
- Mixed implementations. Some institutions add passkeys as an option while keeping SMS as a fallback, which leaves the weaker path open.
How to strengthen sign-in on your financial accounts
- Check your bank's security settings in the app or website for "passkey," "security key," or "sign in with face/fingerprint." Look at your bank's official help pages.
- Create a passkey if offered, and add it on a second device or a hardware key as backup.
- Remove SMS as a fallback if your bank lets you and you have another recovery method.
- Add a carrier account PIN or port-out protection with your mobile provider to reduce SIM-swap risk.
- Use a password manager for any account still using passwords, with a unique password for each.
- Never share codes. Your bank won't call or text asking you to read one back.
Explore the payment path Related field note
FAQ
Is a passkey the same as using my fingerprint? Not exactly. Your fingerprint or face unlocks the passkey on your device; the biometric itself isn't sent to the bank [1].
What happens if I lose my phone? Synced passkeys can be restored from your credential manager on a new device. Device-bound passkeys can't, so set up a backup method or second key.
Are authenticator apps better than SMS? They avoid SIM-swap risk, but their codes can still be phished in real time. Passkeys are designed to resist phishing.
Can someone steal a passkey from the bank's servers? The bank stores only the public key, which can't be used to sign in on its own [1].
My bank doesn't offer passkeys. What should I do? Use the strongest available option, lock down your mobile carrier account, turn on alerts, and ask the bank whether passkeys are planned.
Sources
- FIDO Alliance, "Passkeys," https://fidoalliance.org/passkeys/, accessed 2026-09-17.
- Passkeys.dev (FIDO Alliance and W3C community resource), https://passkeys.dev/, accessed 2026-09-17.
- Cybersecurity and Infrastructure Security Agency, "Mobile Communications Best Practice Guidance," https://www.cisa.gov/resources-tools/resources/mobile-communications-best-practice-guidance, accessed 2026-09-17.
- Gulf News, "New rule: UAE banks to stop sending OTPs via SMS and email starting July 25," July 2025, https://gulfnews.com/business/banking/new-rule-uae-banks-to-stop-sending-otps-via-sms-and-email-from-july-25-1.500209071, accessed 2026-09-17. Primary: Central Bank of the UAE, https://www.centralbank.ae/.
- Reserve Bank of India, "Reserve Bank of India (Authentication Mechanisms for Digital Payment Transactions) Directions, 2025," September 25, 2025, https://www.rbi.org.in/, accessed 2026-09-17.
- Federal Communications Commission, "Protecting Consumers from SIM Swap and Port-Out Fraud," Report and Order, FCC 23-95, WC Docket No. 21-341, adopted November 15, 2023, https://docs.fcc.gov/public/attachments/FCC-23-95A1.pdf, accessed 2026-09-17.
- World Wide Web Consortium, "Web Authentication: An API for accessing Public Key Credentials," https://www.w3.org/TR/webauthn/, accessed 2026-09-17.
- National Institute of Standards and Technology, "SP 800-63B-4: Digital Identity Guidelines — Authentication and Authenticator Management," August 26, 2025, https://pages.nist.gov/800-63-4/sp800-63b.html, accessed 2026-09-17.
- Federal Financial Institutions Examination Council, "Authentication and Access to Financial Institution Services and Systems," August 11, 2021, https://www.ffiec.gov/guidance/Authentication-and-Access-to-Financial-Institution-Services-and-Systems.pdf, accessed 2026-09-17.
- Descope, "UAE Central Bank Bans SMS & Email OTP: What You Need to Know," https://www.descope.com/blog/post/cbuae-notice-3057, accessed 2026-09-17. (Vendor blog; used for notice number and deadline.)
- Khaitan & Co, "RBI (Authentication Mechanisms for Digital Payments Transactions) Directions," https://www.khaitanco.com/thought-leadership/RBI-Authentication-Mechanisms-for-Digital-Payments-Transactions-Directions, accessed 2026-09-17.
This article is for educational purposes only and is not financial, legal, or security advice. Bank features and regulations change; verify current options with your bank and official sources.