SMS OTPs are failing fintech security audits. SIM swap fraud, delivery delays, and phishing susceptibility expose financial apps to losses while regulators tighten requirements under PCI DSS 4.0. Meanwhile, conversion suffers when users wait for delayed messages just to log in.
The solution exists and ships in Android 14: passkeys using FIDO2/WebAuthn standards. These cryptographic credentials bind authentication to user devices in ways OTPs never could—eliminating interception vectors, removing delivery reliability concerns, and satisfying compliance teams simultaneously.
Why OTPs Are Failing Fintech
OTPs solve the wrong problem. They verify possession of a phone number or device, not identity or device integrity. Attackers exploit this gap repeatedly:
SIM swap fraud lets attackers duplicate phone numbers through carrier social engineering, receiving OTPs intended for legitimate users. Malware and overlay apps capture OTPs from infected devices. Phishing campaigns trick users into sharing codes directly—making social engineering highly effective against financial targets.
Beyond security, OTPs create operational friction. Roaming issues, DND rules, and carrier routing problems cause unpredictable delivery delays. For fintech apps where every authentication barrier risks user abandonment, this is a business problem, not just a technical one.
How Passkeys Work
Passkeys replace shared secrets with asymmetric cryptography. The device generates a public/private key pair during registration. The private key remains on the user's device or syncs through the OS keychain. The public key registers with your backend.
During authentication, the server issues a challenge. The device signs it with the private key using biometrics or device PIN. The server verifies using the stored public key. Nothing travels via SMS. Nothing gets typed. The cryptographic binding to domain and device makes phishing and replay attacks structurally impossible.
Recommended Architecture for 2025
Modern fintech authentication stacks multiple mechanisms by risk level:
- Primary login**: Passkey through Android Credential Manager
- Legacy fallback**: Password plus OTP for users not yet migrated
- Device binding**: Hardware keys generated via Android Keystore
- High-risk operations**: Step-up authentication with biometric proof plus cryptographic signature
- Transaction signing**: Per-operation challenges replacing static OTPs
- Dynamic adjustment**: Risk-based friction scaling based on behavior and device signals
This layered approach maintains security without excluding users still transitioning from legacy credentials.
Implementation Pattern
Android integration uses the androidx.credentials library. Registration flows request options from your backend, pass them to Credential Manager, then submit the resulting credential response for verification. Authentication reverses this: backend generates a challenge, user confirms with biometrics or device PIN, and the signed response gets verified server-side.
The backend requires registration option endpoints, credential verification logic, and challenge generation. The mobile app needs Credential Manager integration, biometric prompt handling, and graceful error recovery for network failures or unsupported devices.
Who Should Care
Development teams**: Building passkey support from scratch costs less than retrofitting legacy authentication later. New projects should architect this in from day one.
Product managers**: Authentication failures drive abandonment. Passkeys eliminate delivery delays while improving security posture—a rare win-win.
Compliance officers**: PCI DSS 4.0 and evolving regulatory guidance push toward phishing-resistant authentication. Passkeys satisfy these requirements structurally, not just operationally.
Security teams**: SIM swap, malware, and phishing attacks against OTPs become impossible when credentials bind cryptographically to devices and domains.
Key takeaways
- Passkeys provide cryptographic protection against phishing and replay attacks that OTPs structurally cannot match
- Android's Credential Manager offers a unified API for passkey operations, with backward compatibility for earlier versions
- Layered authentication stacks balance security strength with user experience across different risk scenarios and migration states
Frequently asked questions
What Android version supports passkey Credential Manager?
Android 14 and later provide full Credential Manager support, with backward compatibility mechanisms for earlier versions through Google Play Services.
Can users still use passwords as a fallback?
Yes. Recommended architecture maintains password plus OTP fallback for legacy users during migration periods, gradually shifting traffic to passkeys as adoption grows.
How do passkeys handle device loss or switching?
Passkeys sync through the device's OS keychain (Google Password Manager on Android), allowing recovery on new devices when users authenticate with their Google account.