AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
A passkey is a login that replaces your password with a pair of cryptographic keys: a private key that stays on your phone, unlocked by your fingerprint, face or screen lock, and a public key held by the app or website. Because nothing reusable is typed or sent, a fake website cannot capture it. As at October 2026 we found no Nigerian bank or fintech confirming passkey login on the pages we checked; Nigerian banks mostly use PINs, OTPs, authenticator codes and facial checks, so check your own app's security settings.
How a passkey works, in plain terms
A password is a secret you know and type. Anyone who sees it, guesses it or tricks you into typing it on a fake page can use it. A passkey works differently.
- When you create a passkey for an account, your phone makes two linked keys. The private key stays on your device. The public key goes to the service.
- When you sign in, the service sends a challenge. Your phone asks for your fingerprint, face or screen lock, then uses the private key to sign the challenge.
- The service checks the signature with the public key. If it matches, you are in. The private key never leaves your phone.
- The passkey is tied to the real website or app it was created for, so a look-alike site cannot request it.
Passkey vendor Corbado describes passkeys as cryptographic keys stored on the user's device using public-key cryptography, for a password-free login. Your fingerprint or face is used only to release the key on your own phone; it is not sent to the bank.
Why they matter for banking fraud
| Threat | Password + SMS OTP | Passkey |
|---|---|---|
| Fake login page in a phishing link | Can capture both password and OTP | Passkey will not work on a site it was not made for |
| Scammer on a call asks you to read a code | You can be talked into reading it out | There is no code to read out |
| SIM swap | OTPs go to the fraudster | No SMS involved |
| Password reused from a data breach | Works on any site that shares it | Each passkey is unique to one service |
| Thief with your unlocked phone | Depends on app PIN | Still a risk; keep a strong screen lock and transaction PIN |
The last row matters. A passkey protects login. It does not replace your transaction PIN, and anyone who can open your phone may be able to use passkeys stored on it.
Which Nigerian apps support passkeys?
We could not confirm passkey support at any Nigerian bank or fintech on the pages we checked in October 2026. Corbado's review of Nigerian banking authentication, updated August 2026, names no Nigerian bank using passkeys. It describes other methods instead: facial biometric payments at Access Bank, selfie checks against BVN records in Polaris Bank's VULTe, facial recognition and liveness checks in Wema Bank's ALAT, and voice authentication being tested at UBA. These rely on biometrics but are not passkeys in the technical sense.
Several large global email, social and shopping services offer passkeys; check each account's security settings to see if yours does. Securing your email with a passkey, or at least two-factor authentication, is worth doing now, because email is the reset route for most banking logins. The US Federal Trade Commission's consumer guidance lists strong passwords and two-factor authentication as basic protections wherever they are offered.
What to use until your bank offers passkeys
- An authenticator app for one-time codes, which removes SIM swap risk. See authenticator app vs SMS.
- A transaction PIN that matches nothing else; see the case against one PIN everywhere.
- Biometric app login on a phone only you can open.
- Passkeys on your email account, where available, so the account that resets everything is phishing-resistant.
- Typing your bank's address or opening its app yourself, never following links.
Setting up a passkey where it is offered
- Make sure your phone has a screen lock and, ideally, fingerprint or face recognition set up.
- Open the account's security settings and look for passkeys, passwordless sign-in or security keys.
- Choose to create a passkey and confirm with your fingerprint, face or screen lock.
- Keep your old sign-in method or recovery codes until you have tested signing in with the passkey on each device you use.
- Review the list of passkeys in the account from time to time and delete any for phones you no longer own.
Common questions about passkeys
What happens if I lose my phone?
On many phones, passkeys are backed up to your Google or Apple account and restored on a new device after you sign in. If they were not backed up, you sign in another way and create a new passkey. This makes your Google or Apple account itself important to protect.
Can someone copy my passkey?
The private key is designed not to be exported in readable form. The practical risk is someone with access to your unlocked phone or your cloud account, not someone copying the key over the internet.
Where Pryme fits
Pryme sign-in uses an authenticator app rather than SMS codes, and payments need a transaction PIN; see Pryme security and how Pryme works.
Questions people ask
What is a passkey on my phone?
A passkey is a login stored on your phone as a private key, unlocked with your fingerprint, face or screen lock. It replaces typing a password and cannot be captured by a fake website.
Do Nigerian banks use passkeys?
We found no Nigerian bank or fintech confirming passkey login on pages checked in October 2026. Banks mainly use PINs, OTPs, authenticator codes and facial checks. Check your app's security settings.
Is fingerprint login the same as a passkey?
Not always. Many apps use your fingerprint only to open a saved password or PIN. A passkey uses cryptographic keys and works only with the genuine service.
Are passkeys safer than OTP?
For login, yes in most cases, because there is no code to steal, read out or redirect through a SIM swap. You still need a strong screen lock and transaction PIN.
Sources
- Corbado: Banking biometrics and passkeys in Nigeria (updated 28 Aug 2026) · accessed Oct 2026
- FTC: Are public Wi-Fi networks safe? What you need to know (Feb 2023) · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.