In a city-state where millions of daily transactions flow through a single digital identity system, Singapore has taken a quiet but consequential step: extending passkey authentication to Android users, closing a door that traditional passwords and QR codes have long left open to fraudsters. The move, rooted in open cryptographic standards developed by a global alliance of technology powers, reflects a broader human reckoning with the limits of knowledge-based security in an age of sophisticated deception. With phishing losses already falling sharply, this expansion of Singpass passkeys to And
Singpass passkey security feature now available to Android users
A passkey won't work on a fake website, unlike a password
Mark
So the passkey is basically a key that only works on the real website, not a fake one. How does the system actually know the difference?
Mimi
It's built into the encryption. The passkey is created specifically for that website's legitimate service. When you try to use it on a fake site, the backend verification fails because the fake site doesn't have the matching public key.
Luke
But that assumes the user actually goes to the real website first to create the passkey. If someone gets phished before they set it up, they're still vulnerable.
Mimi
True. The passkey only protects you once it's registered. It's not a shield against the initial trick.
Mark
And 800,000 iPhone users have already done this in two months. That's a decent adoption rate for something optional.
Luke
It is, but we don't know how many of those users actually use the passkey regularly versus just setting it up and forgetting about it.
Mimi
Fair point. The real test is whether the feature sticks and whether people actually use it for their logins.
Mark
The phishing numbers did drop significantly in the first half of 2026. Can we attribute that to the passkey?
Luke
Not directly. The passkey only launched in July, so it wouldn't have affected the first-half numbers. The decline might be from other factors entirely.
Mimi
Right. We're looking at a trend, not proof of cause. The passkey is part of a broader effort, but we can't isolate its impact yet.
Mark
When does desktop support come?
Mimi
End of 2026. So mobile users get it first, which makes sense—that's where most phishing happens.
Le Pouls
- Phishing scams have long exploited the fatal flaw of passwords — they work anywhere, including on fake websites designed to steal them — and Singapore's 5.5 million Singpass users have not been immune.
- The passkey system severs this vulnerability at its root: a cryptographic key pair bound to the legitimate service means a stolen credential is simply inert in a fraudster's hands.
- Starting September 9, Android users are being nudged into the new system via in-app notifications, with a straightforward registration requiring only a biometric scan or six-digit passcode to complete.
- The rollout follows 800,000 iPhone users who adopted passkeys in just two months, signaling strong public appetite for security that demands less effort, not more.
- Phishing cases in Singapore dropped 18% and financial losses fell 68% in the first half of 2026 — a trajectory the Android expansion and a planned desktop rollout by year's end may push further still.
In a city-state where millions of daily transactions flow through a single digital identity system, Singapore has taken a quiet but consequential step: extending passkey authentication to Android users, closing a door that traditional passwords and QR codes have long left open to fraudsters. The move, rooted in open cryptographic standards developed by a global alliance of technology powers, reflects a broader human reckoning with the limits of knowledge-based security in an age of sophisticated deception. With phishing losses already falling sharply, this expansion of Singpass passkeys to Android's vast user base marks not merely a technical upgrade, but a considered shift in how a society chooses to protect its most vulnerable digital moments.
Singapore's Singpass, the national digital identity system woven into the lives of 5.5 million residents and integrated with over 1,400 services, is extending a significant security upgrade to Android users beginning September 9. The feature — called a passkey — works on a principle fundamentally different from the passwords and QR codes most people know: it binds authentication to the legitimate service it was created for, rendering stolen credentials useless on fraudulent websites.
The mechanics are elegant in their simplicity. A private encryption key lives on the user's device; a corresponding public key sits on Singpass servers. When someone logs in, the two keys verify each other — and because this handshake only works with the genuine service, a convincing fake website gains nothing. Passwords, by contrast, function wherever they are typed. QR codes can be captured and replayed. Passkeys cannot.
The Android launch follows a July rollout to iPhone users, which drew around 800,000 registrations in two months — a signal that Singaporeans are willing to adopt stronger security when the process is made accessible. Setup requires updating the Singpass app, tapping a prompt to create a passkey, and completing a one-time biometric or passcode verification. Subsequent logins are handled the same way.
The underlying technology follows FIDO Alliance open standards, shared by an industry coalition that includes Microsoft, Google, Apple, and government bodies from Australia, Britain, and the United States. Desktop support remains unavailable for now, though the Government Technology Agency has committed to extending passkeys to computers before the end of 2026.
The timing carries meaning. Phishing cases in Singapore fell from 3,772 to 3,104 in the first half of 2026, while financial losses dropped from $30 million to $9.6 million — a 68 percent decline. Whether passkeys will deepen that trend is still an open question, but the direction of travel, both in policy and in the data, is clear.
Singapore's national authentication system Singpass is rolling out a security feature to Android users that works fundamentally differently from the passwords and QR codes most people rely on. Starting September 9, Android users will begin receiving notifications from the Singpass app prompting them to create what the system calls a passkey—a form of authentication designed to make phishing scams ineffective.
The passkey system relies on a pair of encryption keys. One key lives on the user's phone; the other sits on Singpass' backend servers. This split design means that even if a scammer manages to trick someone into visiting a fake website, the passkey won't function there. A password, by contrast, works anywhere someone types it. A QR code can be photographed and reused. A passkey is bound to the legitimate service it was created for, making it useless to fraudsters.
The rollout to Android follows a July launch on Apple iPhones, which has already seen significant uptake. Around 800,000 iPhone users have created passkeys in the two months since the feature became available. Singpass itself serves 5.5 million users across Singapore and is integrated with more than 1,400 services—government agencies like the tax authority and the Central Provident Fund Board, as well as private companies including DBS Bank and Singtel. The digital health portal HealthHub also uses Singpass for authentication.
Setting up a passkey requires a one-time registration. Android users need to update their Singpass app, tap a banner labeled "create passkey," and follow the on-screen steps. Once registered, logging in is straightforward: users scan their face or fingerprint using the Singpass app, or enter a six-digit passcode if they haven't set up biometric authentication. The backend system then verifies the private key stored on the user's device against the public key in its system to confirm the login is legitimate.
The technology behind Singpass passkeys follows open standards developed by the FIDO Alliance, an industry group of more than 250 members including Microsoft, Google, Apple, and government bodies in Australia, Britain, and the United States. Several major online services already offer FIDO-compliant passkey authentication alongside traditional passwords and two-factor authentication.
Desktop and laptop users cannot yet use Singpass passkeys, though the Government Technology Agency of Singapore, which operates Singpass, has committed to extending the feature to desktop users by the end of 2026. The timing of this rollout comes as phishing attacks in Singapore have shown signs of decline. The number of phishing cases fell to 3,104 in the first half of 2026, down from 3,772 in the same period the year before. More significantly, the monetary losses victims suffered dropped sharply—from $30 million to $9.6 million, a decline of roughly 68 percent. Whether the passkey feature will accelerate this trend remains to be seen, but the data suggests that Singapore's phishing problem, while still substantial, is moving in the right direction.
Citations marquantes
A user's passkey cannot be shared or exploited, unlike passwords or QR codes, and will not work on fake websites.— Government Technology Agency of Singapore (GovTech)
Envie de l'histoire complète ?
Lire l'original sur The Straits Times ↗
Technology