The Password Is Dying in the UAE First — Here's How Passkeys Actually Work

For decades, the password has been the weakest link in digital security: easy to phish, easy to reuse, easy to steal in bulk from a breached database. The one-time password (OTP) sent by SMS was supposed to patch that hole, but it turned out to have its own weak spot — SIM-swap fraud, where an attacker hijacks a victim's phone number to intercept the code meant to prove it's really them.

The UAE is now one of the first places in the world where regulators have simply ordered banks to stop relying on that system. It's a useful case study for where authentication is headed everywhere else.

What the Central Bank Actually Mandated

The Central Bank of the UAE (CBUAE) began rolling out a directive in July 2025 requiring licensed banks to move away from SMS and email-based OTPs for logins and transaction approvals, with full compliance required by March 31, 2026, according to reporting from Khaleej Times. In their place, banks are adopting a mix of stronger methods: biometric verification such as Emirates Face Recognition, in-app push approvals, behavioral biometrics, and FIDO2 "passkeys" — the same cryptographic standard that Apple, Google, and Microsoft have spent the last three years pushing into everyday consumer logins.

Khaleej Times framed the shift bluntly: by forcing the industry beyond OTPs, the central bank is pushing banks toward "phishing-resistant" authentication. That phrase matters, because it describes something OTPs structurally can't be — a code read over SMS or typed into any website can always be relayed to an attacker. A passkey, by design, cannot.

How a Passkey Actually Works

A passkey isn't a password you memorize or a code you type — it's a pair of cryptographic keys generated on your device when you set up an account. One key stays locked inside your phone or laptop's secure hardware and never leaves it; the other is handed to the website or bank, which uses it only to verify signatures, never to authenticate you directly. When you log in, your device signs a one-time challenge from the server using the private key, unlocked by your fingerprint, face, or PIN. Nothing secret ever crosses the network, so there's nothing for a phishing site to steal even if you're tricked into visiting one.

This is the FIDO2/WebAuthn standard, built jointly by the FIDO Alliance and the World Wide Web Consortium, and it's why passkeys sync across a person's own devices (via iCloud Keychain, Google Password Manager, or a dedicated manager) but can't be copied onto an attacker's machine the way a password can.

The Adoption Numbers, Globally and Locally

The FIDO Alliance's State of Passkeys 2026 report, drawn from roughly 11,000 consumers and 1,400 enterprise security decision-makers across ten countries, estimates that 5 billion passkeys are now in active use worldwide. Awareness has become mainstream — 90% of respondents say they've heard of passkeys, and 75% have enabled one on at least one account. But there's a telling gap between setup and habit: only 49% of people actually use a passkey regularly when a site offers the choice, often defaulting back to a password out of habit or confusion over which login method an account is using. On the enterprise side, 68% of organizations have deployed or are actively deploying passkeys for employee sign-in, yet only 28% have reached the fully passwordless state that 82% say is their ultimate goal.

That consumer gap is exactly what the UAE's regulatory approach is designed to close — rather than waiting for voluntary adoption to climb, the central bank mandated a deadline and removed the fallback option for banks.

The UAE Pass Advantage

The UAE had an unusual head start here: UAE Pass, the national digital identity platform launched in 2018, already gave residents a government-backed, biometric-secured login they were accustomed to using across hundreds of services. Official figures reported by Aletihad put UAE Pass usage above 11 million users as of September 2025, up from roughly 7.2 million in 2023 and 4.6 million in 2022, according to telecoms regulator TDRA data. Gulf News has also reported that UAE Pass has become mandatory for accessing certain government services, such as those from the Ministry of Industry and Advanced Technology. Banks increasingly plug into that same identity layer rather than building separate passwordless systems from scratch, which gave the OTP phase-out a running start that markets without an equivalent national ID scheme don't have.

Not Mission Accomplished Yet

None of this means UAE residents are now immune to fraud. A May 2026 Khaleej Times report on a Zoho-sponsored study found that more than 45% of organizations in the UAE had experienced a cyberattack in the past year, and that adoption of advanced controls — including passkeys, device management, and secure browsers — still lags behind basic protections even as awareness of the risk grows. Mandating passkeys at the bank level doesn't automatically extend to every app, retailer, or email provider a person uses, and attackers adapt: as phishing-resistant logins spread, fraud increasingly shifts toward social engineering that convinces a victim to authorize a transaction themselves, rather than trying to steal a credential at all.

What It Means for You

If your UAE bank has recently pushed you toward Face ID, a push notification, or a passkey setup screen instead of a text-message code, that's not a UX experiment — it's regulatory compliance with a national deadline. The practical upshot for consumers anywhere is the same: when a service offers you a passkey instead of a password, take it. It removes an entire category of attack — the phished password — without asking you to remember anything at all. The UAE's bet is that making this mandatory, rather than optional, is the only way to close the gap between the 75% of people who've set a passkey up and the much smaller share who actually rely on one.