Singapore adds passkeys to Singpass in phishing crackdown

Singapore is rolling out passkey login for Singpass from July 1, starting with iPhone users. The new feature gives users a new way to access digital government and private-sector services through the national digital identity platform. Android support will come in later phases, while the Government Technology Agency of Singapore (GovTech) is also working on support for laptop and desktop logins through web browsers.

The rollout comes as Singapore continues to deal with phishing scams. Phishing was reported as the country’s second-most common scam, with losses nearing S$40 million (approx. $30.8 million USD). Some scams have involved fake Singpass login pages or QR-code flows that trick users into authorizing access under false pretenses.

GovTech says passkeys are designed to make those attacks harder. Unlike passwords, one-time passwords, or conventional QR-code logins, passkey authentication does not leave users with a reusable password or OTP. It works through a pair of cryptographic keys: one stored on the user’s device and another registered with Singpass.

When a user logs in, the phone uses the private key stored on the device to respond to a cryptographic request. Singpass then uses the public key registered in its system to verify that response. The passkey is also tied to the official Singpass login domain, which means it will not work on spoofed websites. Users can unlock the passkey locally with facial recognition, fingerprint recognition, or their six-digit Singpass app passcode.

Device-bound model makes Singpass passkeys more secure

One of the more important aspects of the Singpass rollout is that the passkey is tied to the user’s device. This makes the implementation different from many consumer passkey deployments, where credentials can be synced across devices through services such as a cloud password manager.

Cloud-synced passkeys are practical in consumer accounts because they make recovery and device switching easier. For example, if the user switches to a new device, they can sign in to their cloud account and regain access to passkeys. But Singpass takes controlled approach.

The device-bound model of Singpass is intended to avoid syncing the passkey through the cloud, and to give the platform a way to revoke access if an account is flagged as compromised. The design choice is important for Singpass as it is the country’s national digital identity platform, used to access public and private sector services. This approach also helps with lost or stolen devices: the Singpass app and passkey on the stolen device are automatically deactivated when the user sets up Singpass on another device.

Article Topics

biometric binding  |  biometrics  |  digital government  |  government services  |  passkeys  |  Singpass