Your government login went passwordless before your bank did

The short version

Four numbers frame it:

• 5 billion. Passkeys in use worldwide, per the FIDO Alliance’s State of Passkeys report released on World Passkey Day, 7 May 2026. This is no longer an experiment.
• 1.8 million. Passkeys created in myGov as at Services Australia’s media release of 13 August 2025 — the most recent official count we could find. myGov now prompts eligible users to turn the password off entirely.
• 90 per cent. The share of ubank’s digitally active app customers using passkeys as their preferred login, reported by NAB on 29 October 2025. It is the highest adoption figure published by any Australian bank, and ubank is one of the smallest.
• 65,361. Phishing reports to Scamwatch in 2025, making it the most-reported scam type in Australia, with $97.6 million in losses. Passkeys are the one consumer technology that makes that specific attack structurally fail.

The framing worth holding onto: a passkey is not a better password. It is a different thing that happens to sit in the same box on the screen. A password is a shared secret — you know it, the service knows it, and anyone who can trick either of you into handing it over knows it too. A passkey is a private key that never leaves your device or your password manager, and that mathematically refuses to work on the wrong website. There is nothing for a phishing page to steal.

What a passkey actually is

Skip this if you already know. It matters, because almost every complaint about passkeys comes from expecting them to behave like passwords.

When you create a passkey, your device generates a key pair. The private half stays with you — in the secure hardware on your phone or laptop, or in a password manager that syncs it. The public half goes to the website, which stores it. Storing a public key is harmless: a breach of the site leaks nothing an attacker can log in with, which is why a passkey survives the kind of database dump that forces a mass password reset.

To sign in, the site sends a challenge, your device signs it with the private key, and the site verifies the signature against the public key it already holds. Three consequences follow, and they are the entire value proposition.

The credential is bound to the domain. The browser will only offer a passkey to the exact origin it was created for. A convincing fake of your bank’s login page cannot request your bank’s passkey, and your device will not offer it. Phishing does not get harder; it stops working. Contrast that with an SMS code or an authenticator app code, both of which a person can be talked into typing into the wrong window.

Your biometric is not sent anywhere. Face or fingerprint unlocks the key locally. The service receives a signature, not your face. This is the single most common misconception we see, and it is worth being precise about: the site never receives biometric data.

There is no secret to reuse. Each passkey is unique to one site. Credential stuffing — taking a password leaked from one breach and trying it everywhere — has nothing to work with. Services Australia makes exactly this argument for turning the myGov password off: it “prevents scammers from accessing your account using stolen credentials from other data breaches”.

One clarification on terminology. A passkey is not a second factor bolted onto a password. It is a single step that satisfies both halves of multi-factor authentication at once: something you have (the device holding the key) unlocked by something you are or know (biometric or PIN). That is why security frameworks treat it as phishing-resistant MFA in its own right rather than as a convenience feature.

The Australian scoreboard

How much of this is real, and how much is a press release

The FIDO Alliance is an industry body whose members sell authentication, so its adoption survey deserves the usual scepticism. It is worth reading anyway, because the methodology is disclosed: two studies run by Sapio Research in April 2026, one of 11,000 consumers across ten countries with a stated margin of error of 0.9 per cent, one of 1,400 decision-makers at organisations with 500 or more employees at 2.6 per cent.

The consumer findings: 90 per cent of people are aware of passkeys, 75 per cent have enabled one on at least one account, and 49 per cent use them regularly where available. That last number is the honest one. Half the people who have set a passkey up are not consistently using it, which matches the experience of anyone who has watched a login screen offer a passkey and then quietly fall back to a password because it was faster to type than to go and find the phone.

On the enterprise side, 68 per cent of organisations reported they had deployed or were actively deploying passkeys for staff sign-in, and 82 per cent named fully passwordless authentication as the goal — but only 28 per cent said they had actually got there. The same survey found 33 per cent of consumers had been notified of a breach or account compromise in the previous year.

Our read, offered as opinion rather than sourced fact: the gap between 82 per cent aspiring and 28 per cent arriving is the same gap you see between myGov and the big four. The cryptography was settled years ago. What is slow is account recovery, call-centre process, legacy systems, and the fact that no organisation wants to be the one that locked a million customers out of their money.

Where passkeys still break

Four real problems, in rough order of how likely you are to hit them.

The password is usually still there. This is the big one, and it is under-discussed. Adding a passkey to an account that still accepts a password does not make that account phishing-resistant. It makes your convenient path phishing-resistant while leaving the attacker’s path exactly as it was — and the attacker will always choose the weaker door. That is why the myGov prompt to turn the password off matters more than the passkey itself, and why ANZ Plus removing the password entirely is the more meaningful announcement. If a service lets you delete the password, the deletion is the security step.

Recovery is the new weak point. Move the credential into hardware and you move the risk to what happens when the hardware is gone. Every service needs an answer for the customer whose only phone went into the surf at Bondi, and that answer is a human process: identity documents, a call centre, a knowledge-based question. Social-engineering an account recovery desk is now a more attractive attack than phishing a password, because the payoff is the same and the target is a person under time pressure. Nothing in the passkey standard fixes this. Practically it means two passkeys on two devices, or a passkey synced through a password manager you can reach from a replacement device, plus recovery codes stored somewhere that is not the phone.

Ecosystem gravity. A passkey created in iCloud Keychain syncs across Apple devices; one created in Google Password Manager syncs across Android and Chrome. If your phone and your laptop live in different ecosystems and you have not put a cross-platform manager in the middle, you will create separate passkeys per device — myGov’s own help documentation says exactly this. It is not broken, it is just more setup than the marketing implies. Cross-device sign-in using a QR code and Bluetooth does work, and it is fiddlier than tapping a fingerprint reader.

Shared accounts. Households and small businesses routinely share one login for a streaming service, an energy retailer or an accounting package. Passwords are terrible at this and also, in practice, the only tool most people have. Passkeys are bound to devices and people by design. Password managers have shipped sharing features, but the model is genuinely awkward, and we would not move a shared business account to passkeys without first checking that every person who needs access can actually get it.

The thing that changed in the last year: you can move them

The most common and most reasonable objection to passkeys used to be lock-in. If the credential lives in Apple’s keychain and cannot be exported, switching password managers or platforms means recreating every passkey by hand, one site at a time. That was a fair reason to wait.

It has been addressed, by two complementary FIDO Alliance specifications. Credential Exchange Format (CXF) defines a common JSON representation for passkeys, passwords, one-time-password secrets and notes; Credential Exchange Protocol (CXP) defines an encrypted transfer using Hybrid Public Key Encryption, so credentials never move in the clear the way a CSV export of your passwords does. CXF reached Review Draft status in March 2025, with CXP targeting formal standardisation in early 2026, and the contributor list is the whole field — Apple, Google, Microsoft, 1Password, Bitwarden, Dashlane.

More importantly, it has shipped. Apple included CXF-based same-device credential transfer in iOS 26 and macOS 26, and Android added Credential Exchange Protocol support through a Google Play Services update. Moving between credential managers on a modern phone is now a supported operation rather than a manual rebuild. If lock-in was your reason for not starting, that reason has a shelf life measured in the past tense.

What we would actually do

• Start with the accounts that unlock other accounts. Your email, then myGov, then your password manager itself. Email is the master key to everything with a reset link, so protecting it first does more than protecting ten shopping accounts.
• Turn the password off where the service allows it. On myGov this is an explicit prompt once you have added a passkey or Digital ID. Adding a passkey and keeping the password is a convenience upgrade, not a security one.
• Set up a second passkey before you need it. A second device, a hardware security key in a drawer, or a synced password manager you can sign into from a new phone. Do it on the day you create the first one, not on the day you drop the phone.
• Write down the recovery path. For every account you take passwordless, know what the process is when the device is gone, and store any recovery codes off the device. This is the step people skip and then regret.
• Use one manager across your devices if you mix platforms. An iPhone and a Windows laptop with no cross-platform manager between them means two of every passkey.
• Do not delete a password you cannot recover from. If a service offers no clear account recovery, keep the password, and make it a strong unique one. Passwordless is a good default, not a rule to follow off a cliff.
• Treat any “set up your passkey” link in a message as a scam until proven otherwise. Go to the site or app yourself. Phishing adapts to whatever is new, and enrolment is precisely the moment a user is expecting unfamiliar prompts.

What we could not establish

Several things, and they are worth stating plainly. The most recent official myGov passkey count we could find is Services Australia’s 13 August 2025 media release; we could not obtain a current August 2026 figure, so the real number is higher by an amount we cannot source. We could not verify a launched passkey sign-in for retail customers at CommBank or Westpac, and absence of evidence is not proof — if either has shipped one since, we would like to be corrected. We could not confirm whether ANZ Plus’s passwordless web rollout landed on the mid-2025 schedule it announced, or whether any password fallback was retained in practice. We have no Australian-specific breakdown of the FIDO Alliance’s survey, which covered ten countries without publishing a per-country split. And we have not tested any bank, government or password manager implementation described here, so nothing above is a product recommendation or a security assessment of a particular provider.

The bottom line

Passkeys are the rare security technology that is both more secure and less annoying, which is why five billion of them exist and why the argument about whether they work is over. The argument still live is about the password sitting quietly behind them.

Australia is a genuinely interesting place to watch this, because both ends of the spectrum are running at once. A national government service that prompts millions of people to delete their password. A challenger bank at 90 per cent adoption. A compliance deadline that passed on 1 July for superannuation trustees, and an ASD framework that has quietly relegated the SMS code below the line. And, at the same time, two of the four largest banks in the country with no consumer passkey to speak of, while phishing stays the most-reported scam in the nation.

The useful posture is unglamorous and takes about twenty minutes: add passkeys to your email, your myGov and your password manager, set up a second one on a second device, know your recovery path, and switch the password off wherever the service will let you. The last of those is the one that actually does the work.

Sources

Figures, dates and quotes above are drawn from these sources, captured 21 August 2026:

• FIDO Alliance — Five Billion Passkeys: FIDO Alliance Reports Mainstream Global Usage on World Passkey Day 2026 (7 May 2026): the five billion figure, the consumer findings of 90 per cent awareness, 75 per cent enablement and 49 per cent regular use, the enterprise findings of 68 per cent deploying, 82 per cent targeting fully passwordless and 28 per cent having achieved it, the 33 per cent breach-notification finding, and the Sapio Research methodology of 11,000 consumers across ten countries and 1,400 workforce decision-makers at organisations of 500 or more, conducted April 2026.
• Services Australia — Security prompts helping keep myGov accounts secure (13 August 2025): nearly 1.8 million passkeys created in myGov, more than 2.3 million users switching to passkeys or Digital ID since the prompt was introduced in December 2024, General Manager Hank Jongen’s statements including the prompt to turn the password off and the stolen-credentials rationale, and approximately 3 million Digital ID sign-ins in the preceding month.
• iTnews — Over 200,000 myGov users disable passwords in passkey shift (14 March 2025), reporting the Digital Transformation Agency’s Major Digital Projects Report: the 30 June 2024 launch, 20,000 passkeys in the first week, more than 500,000 in the first six months, more than 200,000 users disabling passwords by the end of 2024, and the $5.6 million project cost of which $3.3 million was design, development, implementation, deployment and testing.
• myGov — Use passkeys: how a passkey is created on the myGov website and in the app, that a passkey is usually saved in a password manager, and that devices using different password managers will not sync, requiring a separate passkey on each device.
• NAB — Ubank expands Passkeys to online banking, marking another Australian banking first (29 October 2025): ubank as the first Australian bank to introduce passkeys in August 2024 and the first across both mobile and online, 90 per cent of digitally active app users adopting passkeys as their preferred login, and Andrew Morrison’s quotes.
• iTnews — ANZ Plus to go passwordless (1 May 2025): the two passwordless web banking methods from mid-2025, app-based approval and passkeys, the statement that these would be the only login methods available, and Maile Carnegie’s comment on data breach and phishing risk.
• ASD — Essential Eight Maturity Model and ASD — Essential Eight maturity model changes: the November 2023 revision requiring phishing-resistant multi-factor authentication at Maturity Level Two and above, including for workstation authentication.
• Financial Services Council — FSC Standards, FSC Standard No. 29 (Fraud and Scam Mitigation Measures for Superannuation Funds): multi-factor authentication for consumer portals and high-risk transactions, fraud and scam policy requirements, annual board attestation, applicability to FSC superannuation full member trustees, and the effective dates of 1 July 2024 voluntary and 1 July 2026 mandatory.
• ACCC / National Anti-Scam Centre — Targeting scams: report on scams data and activity 2025: phishing as the most-reported scam type in 2025 with 65,361 reports and $97.6 million in losses, and combined reported losses of $2.18 billion across Scamwatch, ReportCyber, IDCARE, the AFCX and ASIC.
• Corbado — WebAuthn Credential Exchange Protocol (CXP) and Format (CXF) and 1Password — Securely import and export passkeys: CXF as the JSON credential format and CXP as the HPKE-encrypted transfer protocol, CXF reaching Review Draft in March 2025 with CXP targeting standardisation in early 2026, the contributor list including Apple, Google, Microsoft, 1Password, Bitwarden and Dashlane, Apple shipping CXF-based same-device transfer in iOS 26 and macOS 26, and Android adding CXP support via a Google Play Services update.
• Biometric Update — Australia’s myGov app passes 10M users as digital ID reforms advance (3 August 2026): the 10 million myGov app user milestone and approximately 6 million users signing in with fingerprint or face, cited for context on how far device-held credentials have spread in Australia.