Facebook rolls out passkey support to fight phishing attacks

Facebook is adding support for passkeys on its mobile app. That means you’ll be able to log into the platform using your device’s authentication method, like your fingerprint, face scan, or PIN, making it more difficult for bad actors to take control of your account.

Passkeys offer a more secure alternative to typical passwords because they can’t be stolen, guessed, or leaked. They also provide protection against phishing scams, which occur when a bad actor attempts to trick victims into exposing personal information, often by linking to fake login pages. Since your browser automatically links your passkey with a specific domain, it won’t accept passkeys on phony webpages. But, as pointed out by the Electronic Frontier Foundation, there’s still a risk if you have your password memorized and type it into the fake webpage anyway.

Meta doesn’t provide a specific timeline for when passkey support will arrive, only saying it will launch on Android and iOS “soon.” The company plans on bringing passkey support to the Messenger app as well, where you’ll be able to use the same passkey you set up for Facebook. Both platforms will join several other big names that have adopted the more secure sign-in method, including Google, Microsoft, Apple, and the Meta-owned WhatsApp. 

Even if you set up a passkey, you’ll still be able to use your password to sign into your Facebook or Messenger account. You can log in using other methods, too, including a physical security key or two-factor authentication. Aside from logging into your account, Meta will let you use your passkey when autofilling payment information on Meta Pay as well.