FIs phase out SMS OTPs and passwords in favor of FIDO2 passkeys, zero-knowledge proofs, and decentralized digital credentials.
By BFSINXT Newsroom • Special Launch Coverage
STOCKHOLM / TORONTO — Financial institutions are aggressively sunsetting vulnerable authentication mechanisms—such as SMS-based One-Time Passwords (OTPs), static passwords, and manual document uploads—in favor of cryptographic biometrics and Decentralized Digital Identity (DID) frameworks.
With SIM-swapping, phishing, and man-in-the-middle attacks rendering traditional OTPs insecure, banks are rolling out FIDO2-compliant passkeys across mobile and desktop channels. Passkeys bind biometric data (fingerprint or facial scan) directly to the user’s local device, generating unique cryptographic keypairs for every login and completely immune to remote phishing sites.
Simultaneously, customer onboarding is undergoing a revolution through Zero-Knowledge Proof (ZKP) identity protocols and national digital identity networks (such as India’s Aadhaar/DigiLocker and Europe’s eIDAS 2.0). Customers can now prove their identity, age, or creditworthiness without transmitting raw sensitive documents or identity numbers to the bank.
This cryptographic verification model compresses customer onboarding time from days to under 30 seconds while eliminating the liability of banks storing massive centralized databases of raw identity documents, significantly curtailing data breach exposure.
■ BFSINXT KEY TAKEAWAY
Phishing-resistant passkeys and decentralized zero-knowledge identity are replacing passwords and OTPs, dramatically lowering fraud risk while delivering friction-free user onboarding.
