Cybersecurity: the end of passwords, and what passkeys do for online gambling operators

A forgotten password is annoying right up until it blocks login at the exact wrong moment. In online betting, where odds can move in seconds, that friction is a revenue problem as much as a user-experience problem.

1. According to The State of Passkeys 2026 by FIDO Alliance, 33% of surveyed consumers experienced account compromise or received a breach notification in the last year. The same study found that 47% would probably abandon a purchase or login if they could not remember their password.
2. FIDO Alliance estimated in May 2026 that there were 5,000 million passkeys in active use worldwide. The study surveyed 11,000 adults across ten countries and found that 90% were aware of the technology, 75% had enabled at least one passkey, and 49% used them regularly when available.
3. Passkeys replace the memorized secret with cryptographic credentials that can be unlocked on the device with a fingerprint, facial recognition, or a PIN. That matters because phishing works by tricking users into handing over credentials to a fake platform, and passwords remain one of the easiest things to steal and reuse.
4. Technically, a passkey uses two cryptographic keys: a public key linked to the service and a private key protected on the user’s device. During login, the system verifies the credential without transmitting it, which makes phishing harder and gives better protection to accounts holding balance, personal data, or payment methods.
5. For operators, the catch is simple: authentication is not identification. FIDO Alliance says the user’s fingerprint or face stays on the device and the service receives only the authentication result. That strengthens login security, but it does not replace KYC or fraud controls that determine who is actually behind the account.

That distinction is the one payments and risk teams should care about. A passkey can reduce credential theft and login friction, but in online gambling it sits alongside—not instead of—KYC, fraud screening, and account-level controls.