Account takeovers are becoming more pervasive, costly, and common. In this blog, we’ll explore the key drivers behind ATO attacks, what makes financial institutions higher risk, and what can be done to prevent attacks before it’s too late. 

 account takeover (ATO) attacks rose a staggering 307% between 2019 and 2021 – with the majority of these attacks stemming from compromised login credentials. 

Keyless protects against identity fraud by authenticating the real person with facial recognition biometrics instead of passwords, making it much harder for bad actors to compromise accounts and commit fraud using stolen personal data – we’ll explain how in this article. 

What happens during an account takeover attack?

Account takeovers occur when a bad actor gains access to a legitimate online account and performs benign actions, 

like making changes to a victim’s contact information

, ultimately allowing bad actors to steal funds, or transfer the account ownership to themselves or someone else for a payout.

What do account takeovers look like across different industries?

For a bank, an example of a typical account takeover activity might be:

For an e-commerce platform, a typical account takeover might mean:

ATO attacks are being fueled by the sheer volume of compromised credentials and personally identifiable information (PII) available online that enable bad actors to commit identity fraud. 

This, along with the accelerated pace of digital transformation, weak security, and legacy mindsets are creating a fertile environment for bad actors looking to exploit account security weaknesses that don’t adequately authenticate a customer's identity during high-risk activities.

Most ATO attacks stem from compromised credentials

Unsurprisingly, the root cause of most ATOs stems from compromised login credentials. Once bad actors have access to these, it’s relatively straightforward to launch further attacks against a victim and their accounts. 

According to data, PayPal credentials sell for $161 on average on the dark web. 

Passwords are most often compromised using the below 

Such attacks can and often do lead to serious financial losses as well as increased stress and frustration for victims – 

shows that 45% of those who experienced an ATO attack had money stolen from them directly. 

With switching providers being relatively easy nowadays, it’s important to combat ATO fraud before it has financial consequences for a victim. 

Otherwise, brands risk losing customers to competitors with better reputations and more robust account protections in place.

Because of this, removing credentials from the login equation seems like a sure-fire way to strengthen account protection and ensure customer retention.

Yet despite their obvious pitfalls, many websites and apps still use passwords and PINs as primary authentication methods. This is interesting as 

research shows that cybercriminals are more likely to follow the path of least resistance

 and move onto easier targets if an account has a more robust authentication in place – like facial recognition.  

Beyond password insecurity, modern technologies are enabling bad actors to launch more scalable, under-the-radar ATO attacks that are increasingly difficult to detect without the right tools and technology in place.

For example, fraud syndicates are known to use bots to run automated scripts to launch credential stuffing attacks on masse – this is cost-effective for bad actors while posing a significant risk to victims and businesses. 

Proper account protection requires a combination of technologies and solutions – but strengthening your first line of defense by replacing passwords with more robust authentication solutions can be the difference between a successful and unsuccessful attack. 

By removing passwords from the authentication journey, it’s possible to make your brand immune to ATO attacks stemming from identity fraud and credential theft.

Some of the best means for ATO protection include:

Keyless helps prevent ATO attacks by authenticating the genuine user instead of a set of login credentials like passwords, PINs, or SMS one-time passwords (OTPs).

We do this by combining facial recognition with device recognition. When a user authenticates with Keyless, our technology ensures in real-time that a genuine user is logging in from a trusted device – leaving little threat surface for bad actors trying to breach an account using stolen or compromised credentials. 

Keyless can be used as your first line of defense, or later on during the customer journey when a high-risk action is being taken on an account like changing an address. 

Dynamic Step-Up Authentication for High-Risk Transactions 

In order to strengthen authentication without hurting customer experience, we need to choose authentication methods that are most appropriate to the level of risk, and that won’t drive away and frustrate genuine customers. 

For example, a customer logging in from a recognized device may not need to be authenticated via biometrics to view their balance. 

If however, a customer attempts to add a new payee or order a replacement card after changing their address, it makes sense to authenticate that user using something more reliable than passwords or PINs.

If your fraud solution detects unusual or high-risk activity on an account, Keyless can be dynamically deployed to initiate a seamless step-up authentication flow to ensure it is in fact the genuine account holder attempting the activity. 

Our facial recognition technology will quickly detect whether it is a genuine customer (the same person who originally opened the account) or a bad actor – stopping identity fraud in its tracks while offering a seamless authentication flow for genuine users.

By making it harder to get into a user’s account in the first place, you can dramatically reduce the scope of an ATO attack. 

The threat of ATOs is real. Identity fraud is becoming more sophisticated and pervasive. Without the right tools and solutions in place, ATOs attacks can lead to immense frustration and financial losses for customers – damaging brand reputation and hurting customer retention.  

Luckily, the majority of ATO threats can be prevented simply by replacing passwords, PINs, and OTPs with more robust authentication methods like facial recognition. 

Doing this can stop customers from falling victim to fraud caused by ATO attacks, while also offering seamless authentication journeys for genuine users. In other words, the key to stopping ATO threats is to change how we authenticate users.

Account Takeover Fraud – What Are The Key Drivers, Risks, And What Can Be Done To Prevent It

For banks and payment service providers, the rollout of Strong Customer Authentication (SCA) under the revised Payment Services Directive has added a layer of complexity to payment security that has many wondering whether or not payment authentication can still be frictionless.

Intended to make online payments more secure, the rush to implement SCA-compliant solutions has also created a number of challenges for financial institutions, most notably an increase in failed transactions and frustrated customers.

 from Barclaycard Payments highlights that over 43,000 daily transactions, totaling £3.64 million, were declined in February this year alone because of the changes. 

 conducted by Forter in 2019 indicates that approximately one in three transactions are lost owing to complex authentication flows.

In this article, we’ll explore the impact that SCA is having on the financial services sector’s ability to offer secure and frictionless payments to its retail and merchant customers.

In theory, the payment experience for consumers should be one of enhanced security with fewer instances of friction. Instead, the requirement for SCA has seen legitimate customers being treated like they are committing fraud because an online store’s payment partner isn’t PSD2 SCA ready.

And while many banks and PSPs did manage to implement an MFA solution ahead of the SCA deadline, some rushed to do so, and as a result, are now dealing with numerous security and user experience issues caused by complex authentication flows and new security vulnerabilities.

Strong authentication doesn’t always mean better security

Cryptocurrency exchanges, which fall outside of the scope of PSD2 regulation (

), but have championed MFA for years, are still heavily targeted by fraudsters, which begs the question: is adding multiple authentication steps really the best way to prevent payment fraud and account takeover?

Despite mandating MFA for its users, $14 billion was lost to crypto fraud last year (2021), almost 

 from the previous year.  This highlights that preventing fraud is not as simple as PSD2 SCA would make it seem. In fact, adding additional authentication challenges to inherently weak and incumbent security solutions is comparable to putting a newspaper over a broken window. 

What financial services organizations must realize is that merely falling in line with PSD2 SCA is no guarantee of strong security. In fact, choosing a partner that makes authentication more complicated than it needs to be can damage profitability and undermine payment security goals altogether.

This, combined with the data around revenue loss, should be enough to convince the industry to embrace new technologies that enable seamless and compliant payment solutions that make security intuitive for users.

The financial services industry can benefit greatly from solutions that make payment security intuitive for users and the best way to do this is by reducing the number of steps required to authorize a payment.

Many organizations are embracing passwordless solutions, but the financial services industry is partly reliant on PINs, OTPs, and passwords – all of which have been proven to be insecure.

How can this be done? The key to making security intuitive is to eradicate these methods that require conscious user efforts, such as passwords and OTPS. These methods rely on customers being more security-aware than fraudsters whose strategies are only becoming more sophisticated, large-scale, and successful.

By simplifying payment authentication and embracing passwordless, the financial services industry can not only reduce fraud but decrease the volume of failed and abandoned transactions caused by traditional authentication methods.

Can payment authentication be frictionless?

The demand for seamless and secure authentication experiences is growing. With the rise of contactless payments and remote working, our lives are becoming more digital. Thanks to the likes of Face ID and Touch ID, users are increasingly at ease with passwordless solutions, but these popular solutions aren’t perfect. 

Almost all of today's authentication solutions have exploitable gaps – whether in terms of UX, security or privacy. In this blog, we'll not only answer some of your top authentication questions, but we'll explore how Keyless closes these gaps with biometrics.

1. Why are traditional passwords facing obsolescence? 

passwords weaken your organization's security posture

. When individuals reuse or share passwords, users face elevated risks of identity fraud, data leaks and phishing attacks. Given that over 80% of data breaches are due to poor password security, the security flaws of passwords are clear. For users, having to create complex passwords for each account is bad for UX. And for firms, loss of revenue as a result of identity fraud or non-compliance fines makes passwords a costly expense. 

Many organizations are turning to band-aid solutions like password managers and other password-based multi-factor authentication solutions (MFAs) in a bid to strengthen compliance and security. However, password managers can create greater security risks in the event of an account takeover, and legacy MFAs are burdened by poor UX, forcing users to complete multiple challenges in order to authenticate and access their accounts. How do we resolve those issues? The answer lies in moving towards new modalities that are more intuitive, such as biometrics. 

3. Why has it been difficult to make authentication intuitive and secure at the same time? 

The ideal authentication solution should combine great UX with robust security and privacy. In reality, most authentication vendors fail to do this, often sacrificing one feature over the other in a bid to meet market demands. 

Making authentication intuitive and secure at the same time has been difficult, as the traditional way to increase security is to increase authentication challenges and make password requirements more complex  – resulting in increased friction which impacts churn and . 

For example, an MFA solution that combines passwords with one-time codes may offer stronger security, but the user experience can be clunky and result in churn and increased costs. On the other hand, less friction can sometimes create security and privacy gaps – but new authentication modalities, such as biometrics, are changing this. 

4. What does the future of passwordless authentication with biometrics look like? 

Smart devices have popularized biometrics in recent yers – they are intuitive, eliminate the need for remembering passwords and PINs, and are integrated with many popular apps that people use every day.

It’s clear biometrics are the future – however popular solutions such as Apple’s Face ID and Google Touch are not by any means perfect. In fact, these solutions leave much to be desired from an interoperability and security perspective due to the underlying technology they use to secure authentication data like biometrics and PINs. 

The underlying technology powering solutions like FaceID is 

. Local authentication  became the industry standard for biometric authentication because it secures sensitive data within hardware, or "locally" on a device (as opposed to in on-premise or cloud data storage centers) – making it difficult for biometrics to be compromised by opportunistic hackers.

Locking biometrics to a hardware device however, such as a smartphone or token, creates limitations in regards to account recovery, consistency between different device models, and security gaps with device-sharing. When it comes to authenticating customers, businesses that rely on these solutions have little control over the user journey and security features they offer. 

5. How can biometric data be securely stored and protected without using local authentication technology?

Keyless is the first in the world to apply privacy-preserving technology to biometric authentication

 to make it impossible to steal, hack or leak biometric data – while still processing authentication requests online.

 and distributed cloud architecture, Keyless echoes the principles on which decentralized technology operates, keeping biometric data permanently out of reach of bad actors, solution providers and clients simultaneously – exceeding the requirements laid out under GDPR. 

To accelerate the adoption of biometrics, the focus for innovation will fall into these three areas: 

5 Essential Questions on Authentication and Biometrics

A conversation with Gal Steinberg, VP of Products at Keyless 

Advancements in biometrics are enabling us to transform how we authenticate people and verify their identities, enabling us to authenticate the actual person, instead of the device or the password they use to login. 

To help unpack what this can mean for you, our VP of Products Gal Steinberg, shares his perspective on how biometrics are helping to drive a new era in online security and identity management.

It wasn’t so long ago that biometric solutions were seen as a contentious issue due to fears of surveillance or lack of privacy – but customer demands for frictionless online experiences have been rising steadily over the last decade. We're seeing more users every day demanding smoother online experiences and faster access to online accounts and platforms. 

If there was any uncertainty around user attitudes towards biometrics, technologies like Apple's FaceID have proven without a doubt that consumers prefer biometric authentication experiences – with 42% of users already adopting device-based biometrics.

But are biometric authentication solutions secure?

It depends on the underlying technology. With the sheer volume of leaked data available online, biometrics are undoubtedly more secure than a username and password – however since your unique attributes cannot be replaced if compromised, biometrics can wreak more havoc than passwords if not handled properly

When a biometric data breach does happen, your sensitive data becomes irretrievable. And while the likes of Touch and Face ID deliver a good login experience, in their attempt to protect private biometric data, there are a number of security and interoperability drawbacks to these solutions. 

The number one being, to protect customer privacy, biometrics are often stored on the device instead of online where they are more susceptible to security and privacy threats.  "

Instead of authenticating the actual human being, you're authenticating the device

On every new device a user must enrol for biometrics again, which means businesses actually have low assurance that a user is who they claim to be – as unauthorised users with stolen credentials can register for biometric authentication on their own devices without anyone being able to tell the difference between the two sets of biometrics; on the other hand, not all devices have biometric capabilities, meaning some users don't have the option to use them at all.  

This is why we set out to develop a next-generation biometric solution that uniquely addresses the challenges that come with authenticating users with their biometric

Keyless leverages privacy-preserving cryptography to protect biometric data from privacy and security threats, while also enabling businesses to verify the identity of the user they're authenticating.  

Balancing biometrics with compliance concerns

We've noticed a trend where highly regulated industries are apprehensive or even slow to adopt biometric solutions due to perceived privacy and security risks around biometric data", 

According to Gal, many businesses want to implement biometrics but think they can’t because of compliance and security risks. "

We want to raise awareness about how privacy-preserving technologies can help businesses adopt biometrics while exceeding their compliance obligations under regulations like GDPR and PSD2-SCA. This means our customers can focus on delivering value through biometrics – not scrambling to stay on top of compliance."

Many financial institutions rushed to implement multi-factor authentication (MFA) solutions to meet PSD33-SCA compliance deadlines. However, the rush has proven to be detrimental to some businesses – with the financial services sector being targeted with an influx in advanced social engineering attacks and account takeover fraud despite having an MFA solution in place.  

There are so many ways to do passwordless, but only a subset of solutions are effective,

Many MFA solutions fail to mitigate account takeover fraud and account sharing effectively, so I’d recommend taking the time to understand your pain points and study the landscape to find the right passwordless solution for your needs

Humanizing authentication is a challenge, and we recognize that public confidence in biometrics will take time to mature.

As confidence grows in the potential of biometrics to fight fraud and identity theft, I believe we’ll see it being embraced beyond the consumer space, into markets like the fintech and crypto industries.

Humanizing authentication in the real world 

Some industries, like education, are already experimenting with biometrics to help increase identity assurance in increasingly hybrid environments.

For example, Keyless is being used to help prevent students from cheating in exams. During the first wave of the pandemic, when higher education  moved online, many students had to take classes and exams virtually. 

Universities struggled to ensure students weren't cheating, having noticed some had shared usernames and passwords during the exam period. 

A university came to us after realizing some of its students were enrolling their friends to take their exams,” 

 “It needed a more advanced solution that wasn’t tied to students’ devices to prevent cheating – and so they turned to looking for a biometric solution that could enable this

In financial services, it’s not uncommon for users to endure frustrating authentication processes when accessing critical services and information. The same goes during customer onboarding while service agents are performing their Know-Your-Customer due diligence. But Keyless is helping deliver a more passive, friction-free alternative.

Next-generation biometrics can help businesses transform how their workforce and customers interact with services and devices,

In financial services, where significant fraud and ATO attacks are common, Keyless is helping remove passwords without compromising security while enhancing the user experience

Emerging biometric solutions can allow financial institutions to identify every customer and employee during authentication  – instead of the device. 

Many organizations we work with typically start by trialing biometrics as a proof of concept, trialing new solutions with a subset of users, before rolling the solution out further within their business.

Keyless is seeing groundbreaking examples of biometrics in the consumer space. “

We’re confident that the consumer biometrics market – particularly in banking and payments – will see huge growth in the next five years as awareness continues to expand and more frictionless use-cases emerge in our day-to-day lives

A new era of authentication and identity management 

So, where are biometrics headed over the next decade? According to Gal, they’re expected to be increasingly used within the financial services, banking and fintech sectors as a layered security approach to help protect against rising cases of account takeover fraud and social engineering schemes. 

Secondly, next-generation biometrics will play a crucial role in modern personal identity management. 

I see personal identity management becoming a big part of our lives,” says Gal. “This means everyone gets their own digital identity that only the individual can control. And you can share bits of it to, say, your university, employer, or hospital for them to personally identify and authenticate your unique biometric features.

Simple, secure, private biometric authentication

These are just two examples of where biometrics may be headed. Right now, Keyless are pioneering the next generation of biometrics powered by privacy-first technology.

If you want to learn more about biometric authentication and how Keyless can help you enhance your security and compliance posture, while providing excellent user experiences  please visit our  website. keyless.io/go 

Humanizing Authentication with Biometrics 

Awards season is upon us, and at CogX last month, Keyless took home its first for the year 

Last month we attended the CogX 2022 awards in London – and to our delight we left with the award for 

 and Privacy! It’s always humbling for our team whenever we receive awards like these. 

Although Keyless is new, our technology is the result of almost a decade of research into mobile biometrics and privacy-preserving cryptography, as well as months of testing and development. For those that weren’t aware, we’re the first in the world to build a privacy-preserving solution that enables businesses to securely adopt biometric solutions without any risk to biometric data.

Powerful, Seamless and Private Authentication

With its privacy-first passwordless technology, Keyless is helping companies to improve customer journeys while strengthening compliance and reducing the overall impact of fraudulent account takeovers and identity theft.

Since we launched in 2020, we’ve continued to receive awards and nominations for our unique use of technology. While we’re very humbled by the awards, we’re also proud to share them with the world. 

Below is a list of awards and nominations we’ve received so far 

Keyless Wins Best Award at CogX London 2022

Just in case you weren’t able to make it, we’ve wrapped up the most important lessons from our latest webinar with Auth0! 

’s Head of Partner Enablement, Tobias to discuss how organisations

can build for the future of identity, and leverage new regulations to make strong authentication their competitive advantage.

Here are the most valuable points from our key takeaways: 

Identity assurance and user friction – finding the right balance

One of the key things we discussed during yesterday’s webinar was how you can find a competitive balance between strong security and frictionless user experiences. 

Tobias rightly pointed out that businesses that integrate overly complex login solutions tend to drive customers away from their platforms and services, and this can quickly result in lost revenue, as well as a profound decrease in overall customer satisfaction. 

In contrast, businesses that offer intuitive solutions – like passwordless social login – are reporting up to a 50% increase in online conversions. 

Yet despite the clear business case for implementing a passwordless solution into your digital applications and platforms, many of you may still be hesitant to part with traditional multi-factor authentication methods due to perceived security and privacy risks, and an increasingly unforgiving regulatory environment.  

So many of you may be grappling with the age-old dilemma: should you prioritise strengthening security and privacy, or reducing friction and increasing revenue? 

As Tobias and Fabian pointed out, Keyless and Auth0 are helping to solve this long-standing trade-off – making it possible to provide frictionless digital experiences while meeting strict compliance requirements.

Face ID and other local biometric authentication solutions leave much to be desired

Keyless stands out from other popular biometric authentication solutions (most notably FaceID) because our technology does not rely on the devices current features and capabilities.

Instead, we’ve developed our own secure biometric software that can be used on any device – and as a testament to our technology, we're one of 

the only authentication vendors in the world

 – the highest level of international certification in biometric authentication and security.

Our certified software can be used on any modern device with a front-facing camera – whether that be a tablet, laptop or mobile – or an Apple, Samsung, Google, Windows or Huawei. This, along with our advanced encryption technology, is one of the key reasons why Keyless is attracting partners like Auth0.

The ability to use Keyless across different devices and brands, Fabian explained, also means your end-users only need to register for biometric login once. Once they’ve registered, those same biometrics are recognised across all of their trusted devices. This enables users to self-manage device revocation and account recovery – dramatically reducing the burden on your support teams. 

It also makes it impractical for end-users to allow friends and family to access their accounts using FaceID or equivalent on their own devices (aka credential sharing) – as trying to login with a different set of biometrics on another device will result in the user being locked out. 

It’s possible to verify identity at every touch point 

What really sets our technology apart is that we can verify an end user’s identity at every touchpoint – all without compromising on privacy, security and the user having to repeat extra identity verification steps across new devices – a clear win-win. 

Again, Keyless can do this because we do not rely on the device's in-built technology. 

You can adopt passwordless biometric authentication without breaching GDPR

Thanks to breakthroughs in privacy-enhancing technologies, it's possible for us to provide secure biometric authentication without you needing to worry about your end-user data being stolen, leaked or otherwise compromised. 

As Fabian explained during the webinar, Keyless uses a patented combination of technologies to ensure encrypted biometric data can never be used to reconstruct a user’s original biometrics – and that no one ever has a complete encrypted template. 

For more info on our breakthrough technology, check out our 

There’s still time to make passwordless your competitive advantage

During the webinar, Tobias shared interesting data comparing end-user attitudes towards different types of strong authentication solutions compared with what applications currently offer.

The biggest takeaway from this is that frictionless strong authentication solutions are not yet a commodity and that you can turn strong customer authentication requirements into your competitive advantage by adopting solutions that balance strong security, privacy and user experience – as Keyless does!

Auth0 and Keyless can support you on your identity journey

 The last, and potentially most important, takeaway from yesterday's webinar was that your identity and authentication partners are there to serve you. Auth0, or whichever vendor you use to manage identities, can help guide you while you navigate staying compliant and competitive in an evolving identity landscape.

Similarly, Keyless is here to help support you when it comes to authentication and knowing which authentication solution is best for supporting you and your unique business case. 

Ready to start your passwordless journey? Get started today.

Whether you’re looking to enhance security for your customers, employees or business partners – Keyless is here to help. Our FIDO2-certified, biometric software solutions can help modernise the way you manage identities across all touch points – while ensuring unparalleled privacy for all your end-users. 

check out Keyless on the Auth0 Marketplace

 to learn more about how we can support you in your passwordless journey.

Key Takeaways from Unlocking a Frictionless Futures Webinar with Auth0

Ever since “cloud computing” hit the headlines (

), people have been predicting the end of on-premise solutions. After all, why do we need on-premises when we can achieve things like greater cost efficiencies, flexibility and better uptime SLAs in the cloud?

The fact of the matter is - while conceptually, the cloud beats on-premise hands down - reality continues to play out differently. Particularly for enterprise organizations who have complex infrastructures, legacy technologies and thousands of users - staff, business partners and customers - accessing systems. Add to that, for some highly regulated industries (think financial services for example) where regulation is so strict, it makes moving to the cloud a difficult sell.

So, let’s start unpacking some of those aspects which slow down, or currently prevent organizations from moving to the cloud:

It’s safe to say that this is the biggest barrier for organizations. Cloud computing utilizes multiple data centres, with some of those data centres hosted countries who hold different views on topics such as data privacy. And from a compliance point of view, some regulators absolutely won’t let data out of the country or region the business operates in, in order to preserve that data privacy.

Additionally, from a security point of view, cloud computing providers may not have the high enough levels of security built into their architecture that some organization types need, and if customer data (for example) is centrally stored in the cloud, that risk is then too high for them.

No business starts out with plans for how they want to look and work in 10 or 20 years time. Organizations grow, for the most part, organically. Departments grow, business units are created, acquisitions are made, and people naturally end up working in silos, which means processes, technologies and data end up in silos too. Users accessing the company’s technology also increase and vary - from access management rights for staff through to business partners and customers.

Migrating to the cloud can add dependencies to existing infrastructures which not only increases administration, but it can have very harmful effects such as customer data being stored across multiple instances, which could cause disruption to the customer experience, not to mention the inefficiency and insecurity of such an approach opening the business to unacceptable risk.

When it comes to cloud computing, there are multiple choices and working out which one is the best fit, that will bring value, be secure and improve operations and user experience (think of how many times or places your employees or customers are being asked to login or authenticate) and the road to cloud adoption gets complicated, fast.

And for those organizations who have to still use on-premise solutions, they will automatically have the requirement for a hybrid approach, which is a challenge for some cloud providers as they can’t offer the same level of data storage, protection and SLAs on-premise that they do in the cloud.

So how can organizations who need to maintain on-premise solutions, but also want to have the option of utilizing the benefits of a cloud solution (at some point), move forward?

Here at Keyless, we’re aware that some of our customers have been experiencing the pains we’ve just been speaking about. And while we can’t solve the entire on-premise-cloud conundrum, we are pleased to say we’re doing our part when it comes to how you can manage digital identity and authentication for your users, business partners and customers: with Keyless On-Premise. It will work just like our existing solutions do - just like an on-premise service. We feel this is an important step, especially for our customers in those highly regulated industries, who can’t quickly or easily move to the cloud. We can offer our customers the ability to quickly adopt and deploy cutting edge technology - without the need to complete a multi-year digital transformation project first. 

If you would like to find out more, please 

Why is On-Premise still here?

There’s been a lot of buzz in the identity and access management market in recent years as new kid on the block – Passwordless Authentication – has been gaining popularity, if not full-scale adoption. 

According to Gartner, by 2025, more than half of the workforce and more than 20% of customer authentication transactions will be entirely passwordless – up from under 10% today. So whether they are ready to or not, organizations must start considering passwordless authentication as a serious option for their login and authentication flows, regardless of use case.

But... passwordless just tells you what the authentication method is not. So, what is passwordless?

This blog will give a brief overview on what passwordless is and what organizations can look out for when considering passwordless authentication solutions. First of all, passwordless authentication methods are available in a few wrappers:

For example, a user could be asked to authenticate as part of a multi-factor process, where they are asked to enter a pattern (something they know) and then enter a one-time pin, delivered most often through their phone (something they have). And even if a password is baked into the first step, the addition of a passwordless second authenticator greatly increases security. That said, while security is increased, it is still compromised by the fact that a password is involved.

Furthermore, there is still the matter of user experience (UX), even if the security box is checked. Multiple authentication methods, across different devices, is hardly the frictionless UX organizations hope to offer their customers.

Biometric authentication is also a great passwordless option, and adoption of this is on the rise. This is in part, thanks to Face ID and Touch, who embed biometric authentication into their devices. Additionally, some biometric authentication solutions also lean on devices, by storing biometric data on the device. While this is certainly a great way to get user buy-in, it still presents organizations with some challenges, most notably, in a couple of areas:

However, passwordless biometric authentication is already moving beyond on-device and it’s challenges. Keyless is a next-gen biometric authentication solution that does not rely on a particular device and eliminates the need to process and store biometric data. This enables passwordless authentication for users in a way that exceeds GDPR and is PSD2 ready. With device-agnostic software, organizations have the ability to provide a consistent and intuitive user experience, that is user friendly, private and secure. It works either as a single factor authenticator or as part of a multi-factor authentication experience, integrating with an existing identity provider (IDP).

Now that we’ve looked at the passwordless authentication methods, what do organizations need to consider for use in their organization, whether for employees or their customers? Here are a few suggestions:

the first vendor in the world to have certification for both FIDO2 and FIDO biometrics

 - which means that our passwordless biometric authentication is approved for both employee and customer use cases. Additionally, if you want to read more from Gartner on this subject, we can also recommend Gartner’s paper, Take 3 Steps to Passwordless (in which we’re also cited).

 Finally, if you’d like to learn more, you can visit our 

schedule a quick call with a Keyless expert. 