The Key You Can't Lose (Except You Can): What UK Banks Owe You in the Passkey Era

Somewhere along the way, 'passwords are rubbish' stopped being a niche complaint and became industry consensus. Which is why, over the past couple of years, a growing list of UK banks and building societies have started letting customers log in with a passkey instead of typing something they'll forget and then reuse on eleven other sites.

Good. Genuinely. But there is a pattern in how these things get sold to the public, and it usually involves explaining the benefit in detail while murmuring the trade-offs. So let's do the trade-offs properly.

The pitch, in plain English

A passkey is a replacement for the thing you type. Instead of a shared secret that both you and the bank know — and that a scammer can therefore steal, guess or buy off a database — your device holds a private key that never leaves it, and the bank holds a matching public one.

To log in, you unlock your phone or laptop the way you already do: fingerprint, face, or PIN. That biometric doesn't go anywhere; it just authorises the device to sign a challenge from the bank. Because the signature is tied to the specific website or app, a convincing fake login page has nothing to harvest. There's no code to read out to a helpful caller from 'the fraud team'.

In practice, passkeys sync through whatever keychain you already use: iCloud Keychain on Apple gear, Google Password Manager on Android and Chrome, or a third-party manager like 1Password. The passkey you create on your phone turns up on your laptop, and moving between ecosystems involves a QR code and the two devices being near each other.

That's the mechanics. Now the interesting part.

Where the UK rollout actually stands in 2026

Patchy would be the diplomatic word. Big Tech got there first — Apple, Google and Microsoft accounts, plus a long list of shopping and social sites — and consumers have been quietly accumulating passkeys without necessarily noticing.

UK banking has been slower and more cautious, which is fair enough given what's at stake. What we've seen so far is mostly app-based logins and step-up authentication for higher-risk actions, rolled out in waves rather than to everyone at once. Some banks are further along than others; several are still treating it as a pilot for a subset of customers. Regulators have been broadly encouraging, and the fraud-reduction argument is a strong one, because the dominant attack — credential phishing — is precisely what passkeys break.

So the direction of travel is clear. The question is what gets built along the way.

The awkward bits nobody puts on the marketing page

Losing the device is now losing the keys. A passkey that lives only on a phone you've left in the back of a taxi is a passkey you no longer have. Synced passkeys solve most of this, but only if sync was switched on and only if you can still get into the account that holds them.

Recovery is the soft spot. Here's the argument that should be louder than it is: passkeys harden the front door, so attackers go looking for the spare key under the mat. If a bank's fallback for 'I've lost my phone' is a text message to a number that can be SIM-swapped, or a helpful human on a phone line who can be socially engineered, then the security gain shrinks to whatever the weakest reset path allows. Some genuine improvements have been made here, but the industry has not been remotely clear with customers about which path is used when.

Lock-in, of a new kind. Your passkeys live in a manager. Moving from an iPhone to an Android handset, or from one password manager to another, is doable but fiddly, and the experience is not standardised across every provider yet. Standards work is under way. Standards work is always under way.

The shared-phone household. Not everyone has a personal handset with a modern biometric sensor. Couples share devices. Carers manage phones for relatives. Corporate handsets get wiped by IT departments. A passwordless future that assumes one person, one phone, one face is a future that quietly excludes a chunk of the people who need fraud protection most.

The phone call problem. If your banking is terminal-only and the app breaks, what happens? Call-centre identity checks become the back door, and back doors are where the fraud ends up.

Four things to demand before you trust them

This isn't an argument for sticking with passwords. It's an argument for asking better questions while the rollout is still being designed.

One: two passkeys from the start. Register a second device — a tablet, a spare phone, a hardware security key — on day one, not as a feature that arrives in a future update. A single point of failure with excellent cryptography is still a single point of failure.

Two: recovery that doesn't quietly fall back to SMS. If the reset path is weaker than the login, the login is theatre. Ask what the recovery options are, and ask whether you can remove the weak ones.

Three: portability. Passkeys should move between providers as easily as a contact list. If your bank's implementation only works with one vendor's keychain, that's not a standards problem, that's a commercial choice.

Four: plain liability. If someone drains an account through a recovery flaw in the bank's own system, who pays? Consumers should not have to read a tribunal ruling to find out.

And an unwritten fifth: no silent enrolment. Turning passkeys on should be a decision you make, explained in a screen you can actually read, not a toggle that appears mid-update because a product team hit a deadline.

The verdict

Passkeys are the right direction, and the phishing argument alone justifies the effort. Nobody should be talked out of them by the fact that the transition is messy.

But there's a habit in financial technology of selling the shiny front end and burying the plumbing. Passwords are bad, so passkeys are good — and everyone moves on before asking what happens when the phone is at the bottom of a canal on a bank holiday Monday.

Adopt them. Then nag your bank about recovery, second devices and portability until the boring parts are as good as the demo.