Passkey adoption by Australian govt, banks drives wider passwordless authentication

It’s high noon for passwords. Across the Authentication Corral, an inscrutable stranger saunters up and puts their hand on the mobile device in their holster. Many have cast their phishing nets far and wide to try and nab some scrap of personal information from this figure with a hidden identity. All have failed.

Passwords won’t give in – but their knees are quaking. They look old and tired. Stagnant. Forgotten. Everyone can see their time is up.

Slowly, the stranger pulls out their phone, performs a quick biometric authentication check to FIDO standards and easily logs in. Across the corral, passwords collapse, bleeding out long strings of letters, numbers and special characters.

And every digital identity provider, every ID verification and authentication firm staring out at the showdown and its grisly aftermath, knows.

From now on, this town belongs to passkeys.

Passkey deployment by myGov drives wider adoption in Australia

While the scenario playing out in Australia is not exactly as described above, the transition from passwords to passkeys for authentication has acquired the flavour of a spaghetti western. A promotional push from the government and several high-profile adoptions have led to a general increase in uptake, and major banks are throwing shade at passwords and threatening to kill them off.

At this point, the writing is on the wall. According to an article by Ashley Duffy of Ping Identity, the implementation of passkey authentication on the myGov app has been a success, as “the number of myGov account holders who took up the capability grew from 20,000 in early July to 170,000 in late August.”

Writing for Technology Decisions, Duffy says that on top of the government deployment, some of the technical challenges that were identified two years ago as roadblocks to passwordless authentication have now been solved.

“A key change has been to the operation of the security protocols that underpin passkeys and passwordless authentication. As this has improved over time, it has engendered more trust in the technology among technology teams and organisations, leading to increased adoption and use.”

“At the same time, users have become more comfortable with biometrics to authenticate to digital services.”

Implementation and enablement have also improved, leveraging templates and no-code, drag-and-drop orchestration to “allow administrators to swiftly design, test and deploy various out-of-the-box passwordless registration and authentication experiences for diverse customer identity types, all at scale, with minimal manual setup.”

Meanwhile, Australian customers are embracing digital wallets for payment transactions, with numbers from the Reserve Bank of Australia (RBA) showing that more than 500 million payments were made via mobile wallets in October, totalling over $20 billion.

In a release, Australian Banking Association CEO Anna Bligh says the “massive surge in mobile wallets demonstrates a clear shift towards digital payment solutions. Go back a decade, and almost no one was making a digital wallet payment. Now we’re seeing over half a billion payments being made with mobile wallets in just one month.”

Banks transition to passkeys driven by youth preferences

Banks are among the major drivers of passkey adoption in Australia. According to an article in the Sydney Morning Herald, National Australia Bank (NAB) chief security officer Sandro Bucchianeri says passwords are “terrible” – and on the way out.

Ubank, a digital subsidiary of NAB, has already extended passkey capabilities to its customers, and Bucchianeri foresees NAB following suit within the next three to five years. The transition is being driven in part by research from ubank showing that more than 50 percent of Australians between 18 and 43 say one of most effective ways for banks to prevent scams is through encryption and secure authentication, and 38 percent say they have the most confidence that biometric authentication methods will protect them from identity theft, scams and fraud.

Ashley Duffy says Australia’s banks have shown “a keen interest in setting up their mobile apps as a place where customers can initiate all sorts of transactions, from monetary transactions through to seeking assistance from contact centre agents,” and expects in-app services to drive a continued increase in passkey adoption.

Regulator seeks public input on authentication, pushes passkeys

Encouraged by a “significant drop in fraudulent high-risk customer transactions” following the implementation of the Telecommunications Service Provider (Customer Identity Authentication) Determination 2022, the Australian Communications and Media Authority (ACMA) has tabled proposed variations to the customer ID authentication rules in a public consultation paper.

Proposed changes include introducing passkeys as an efficient ID check, allowing accredited digital identity services to be used as a primary ID check, changing how biometrics can be used to reflect fraud risks, and enhanced privacy guardrails.

The stated goal is to “support innovation, strengthen the requirements to protect vulnerable people and provide further clarity to the telecommunications sector.”

Specific questions pertaining to passkeys include, “Do you agree or disagree with including use of a passkey as an alternative first-factor identity authentication process?” and “Does it pose any security or fraud risks? If so, please describe these in detail.”

Notably, the paper also asks if the definition of passkey in the draft is appropriate, reflecting the ongoing effort to find language that fully and clearly answers the question, what is a passkey and what does it do?

The full consultation paper, ​“P​roposal to vary the Telecommunications Service Provider (Customer Identity Authentication) Determination 2022,” is available for download. Submissions are open until February 14, 2025.

Article Topics

Australia  |  banking  |  biometric authentication  |  biometrics  |  FIDO Alliance  |  myGov (Australia)  |  passkeys  |  passwordless authentication  |  telecom