A woman holds a smartphone displaying the VNeID national digital identity app. The platform provides digital identification and authentication services for users. — VNA/VNS Photo

Mai Hương

HÀ NỘI — Passwords and one-time passwords (OTPs) remain common ways for people to access online services, but a new form of authentication known as passkeys is gaining ground globally as companies look for more secure and convenient alternatives.

Unlike passwords and OTPs, which can still be intercepted or tricked out of users through phishing, passkeys use cryptographic credentials designed to resist such attacks.

The technology is still relatively new to many users in Việt Nam, but the country is already strengthening digital identity and biometric authentication across public and financial services. The expansion of VNeID and the wider use of biometric verification are also making people more familiar with proving their identity digitally.

Globally, however, passkeys are gaining traction, although adoption remains at an early stage in many markets.

The global industry body that develops standards for secure, passwordless authentication FIDO Alliance said in 2026 that five billion passkeys were in active use worldwide, while 75 per cent of consumers surveyed had enabled at least one passkey and 49 per cent were using them regularly when available.

For Edwardcher Monreal, Principal Solutions Architect for Identity and Access Management, Consumer Authentication Solutions at HID, the shift is not simply about replacing passwords with another way to log in.

“One of the key problems that we have with passwords is that [they are] phishable. It’s also very easy to steal and replicate,” he said, adding that even OTPs, widely used as an additional layer of security, remain vulnerable to phishing.

But the move towards passwordless authentication also raises a broader question: if the login itself becomes more secure, where will the next weak points appear?

Edwardcher said organisations need to look beyond the login screen and secure other parts of the digital customer journey, including account opening, device changes, transactions and account recovery.

This is becoming more important as cyber fraud evolves. Artificial intelligence is making it easier to create convincing fake identities, documents, voices and faces, meaning that verifying a person may no longer be enough to protect an account throughout its lifecycle.

A 2025 Gartner survey found that 62 per cent of organisations had experienced at least one deepfake attack involving social engineering or automated processes in the previous 12 months.

Businesses therefore need to assess the context and risk of each transaction, adding stronger authentication only when necessary rather than treating login as the only security checkpoint.

Việt Nam has room to move faster

Việt Nam may have an advantage in adopting the new approach because much of its digital identity infrastructure is still developing, according to Edwardcher.

Edwardcher Monreal, Principal Solutions Architect for IAM at HID. — VNS Photo Mai Hương

VNeID is being expanded into a broader digital platform for public services and electronic transactions, while the national digital transformation strategy for 2026-30 identifies digital identity and authentication as key shared digital platforms.

He compared VNeID with Singapore’s SingPass, saying Việt Nam was in a good position to adopt passwordless authentication because users were already becoming familiar with digital identity and biometric verification.

“The pace, however, is likely to differ across sectors,” he said.

Banking, government services and private businesses have different requirements and levels of readiness, while regulation can play an important role in accelerating adoption.

Rather than copying approaches from more mature markets, Edwarcher said Việt Nam could follow widely accepted standards such as FIDO while adapting implementation to local requirements and the different needs of industries such as banking, government and enterprise.

He highlighted the Vietnamese Government’s efforts to accelerate the development of digital identity infrastructure, alongside growing investment by local technology companies. 

The push is backed by Resolution 57-NQ/TW, which places digital transformation at the centre of building digital government, a digital economy and a digital society, creating a broader policy foundation for the development of digital identity and authentication.

Passwordless does not mean risk-free

The shift also comes with new challenges.

Device-bound credentials can make authentication harder to compromise remotely, but they create new questions when a user loses, replaces or changes a device. Account recovery and device enrollment therefore need to be secured as carefully as the initial enrollment process.

Biometrics also raise privacy questions over where users’ data is stored and processed. Verifying users locally on their devices can reduce these concerns, as biometric information does not need to be sent to a central server for authentication.

The principle, Edwardcher said, is to "verify the person locally, protect the credential on the device and share only the information needed by the service”.

In this sense, the move beyond passwords is not about finding a single technology that solves digital security. It is about changing how authentication is designed – from a one-time check at login to a system that considers the person, device and action throughout the digital journey.

Over the next three to five years, passkeys are expected to become increasingly common, while authentication becomes more context-driven.

Fewer passwords and OTPs may make digital services easier to use, but businesses still have to ensure that the person behind each digital action is who they claim to be. — BIZHUB/VNS