Daon's Conor White Challenges the Idea That Passkeys Alone Stop Account Takeover

Why Credential Security Is Not Enough in Financial Services

Conor White, president of strategic initiatives at Daon, argues that while passkeys eliminate phishing risks for credentials, they do not fully protect regulated firms like banks from account takeover. He explains that passkeys secure the login process but leave other attack vectors open, such as session hijacking or social engineering after authentication. This view challenges the growing belief that passkeys are a complete solution for identity security in high-risk industries.

White emphasizes that phishing resistance only safeguards the credential itself, not the entire authentication journey. Once a user logs in with a passkey, attackers can still exploit weaknesses in session management, device trust, or recovery processes. Regulated firms, which face strict compliance requirements, must look beyond credential security to address these broader risks. He notes that relying solely on passkeys creates a false sense of security in environments where fraud tactics evolve rapidly.

White points out that banks and financial institutions are prime targets for sophisticated attacks that bypass login altogether. For example, malware can hijack active sessions, or attackers can trick users into approving fraudulent transactions after login. He stresses that passkeys do not prevent these types of fraud, which often rely on manipulating the user or exploiting trust in verified devices. True protection requires layering passkeys with behavioral biometrics, real-time risk analysis, and continuous authentication.

How Should Regulated Firms Adapt Their Authentication Strategy?

He also highlights that recovery mechanisms for passkeys—such as backup codes or device transfers—can become new weak points if not properly secured. Regulated firms must ensure these processes meet the same security standards as the initial login. White urges organizations to adopt a holistic identity strategy that includes monitoring for anomalies throughout the user session, not just at the point of entry.

White suggests that firms should treat passkeys as one component of a multi-layered defense rather than a standalone fix. He recommends combining them with adaptive authentication that adjusts security based on context, such as location, device health, and user behavior. This approach allows for stronger protection without compromising user experience. He also advocates for stronger integration between identity proofing and ongoing fraud detection.

According to White, the future of secure authentication lies in continuous validation, where trust is constantly re-evaluated after login. He believes that firms investing in this model will be better equipped to resist evolving threats while meeting regulatory expectations. Passkeys are a step forward, but they are not the end of the story for identity security in regulated sectors.

Frequently Asked Questions

What is the main limitation of passkeys according to Conor White? Passkeys protect against phishing of credentials but do not stop attacks that occur after login, such as session hijacking or social engineering.

Why should banks not rely solely on passkeys for security? Because attackers can exploit post-login vulnerabilities, and regulated firms need comprehensive protection across the entire authentication lifecycle.

What does White recommend for stronger account security? He advises layering passkeys with behavioral biometrics, real-time risk analysis, and continuous authentication to defend against evolving threats.