Why India is suddenly a serious passkey market
India is becoming one of the most important passkey markets because regulation, payment scale, and ecosystem activity are all moving in the same direction at the same time.
The biggest trigger is the RBI Authentication Directions, 2025. They require two independent authentication factors, with at least one dynamically generated, for all domestic digital payment transactions by April 1, 2026. That does not mandate passkeys by name, but it creates a strong push away from SMS OTP and toward phishing-resistant authentication.
On top of that, the payment surface is enormous. In December 2025 alone, UPI processed over 21.6 billion transactions worth around ₹27.97 lakh crore. When authentication sits on top of a system that large, weak factors stop being a UX annoyance and become a national-scale security problem.
Why passkeys fit the Indian shift away from OTP
A passkey is a FIDO2/WebAuthn credential stored on a user device. Instead of sending a shared secret like a password or OTP, the device signs a one-time challenge with a private key that never leaves the authenticator.
That matters because the failure modes are different:
- Passwords can be reused and stolen
- SMS OTPs can be phished, intercepted, or socially engineered
- Passkeys are bound to the real domain, so look-alike phishing pages cannot replay them
In practical terms, the user approves login or payment with a fingerprint, face unlock, or device PIN, but the security comes from the cryptographic origin binding underneath. That is the part many teams miss when they equate passkeys with “just biometrics.”
India already has strong consumer familiarity with biometric confirmation. But device biometrics alone are not the same thing as passkeys. A biometric prompt can unlock many different authentication methods. What makes passkeys different is the WebAuthn credential and the relying-party binding behind the gesture.
Regulation is broader than just payments
The RBI framework is the clearest adoption driver, but it is not acting alone.
The DPDP Act, 2023 requires reasonable security safeguards to prevent personal data breaches, with penalties of up to ₹250 crore for failure. The DPDP Rules, 2025 add examples such as encryption, access controls, logging, and monitoring. Passkeys map naturally to that direction because they reduce the value of stolen credentials and lower phishing exposure.
Then there is CERT-In. Its directions require specified incidents, including phishing, spoofing, identity theft, and unauthorized access, to be reported within 6 hours. That does not create a passkey mandate either, but it raises the operational cost of weak authentication. Preventing account takeover becomes more valuable when incident handling windows are that tight.
A smaller but still important RBI signal is the migration to the .bank.in domain, with a deadline of October 31, 2025. That is about securing the first point of customer contact before authentication even starts.
Where passkeys are actually live in India
The clearest production movement is in payments.
| Area | What happened |
|---|---|
| Mastercard | Launched Payment Passkey Service in India in August 2024 with Axis Bank, Juspay, Razorpay, PayU, and bigbasket |
| Visa | Launched Payment Passkey in India in July 2026 with IDFC First Bank as first issuer |
| Banks | Retail banking front-door passkey adoption is still early and uneven |
| Consumer platforms | Google, Amazon, WhatsApp, Sony PlayStation, and Zoho already expose Indian users to passkeys |
That pattern matters. India is not starting from zero, but adoption is uneven across layers.
Card networks are pushing first. Consumer platforms are normalizing the UX. Banks are still catching up. And India’s digital public infrastructure, including Aadhaar, DigiLocker, and Jan Parichay, does not yet use passkeys at its core.
That last point is probably the biggest long-term opportunity. If passkeys move from checkout flows into the identity systems used by more than a billion people, India could become the most important large-scale phishing-resistant authentication deployment story anywhere.
The real technical and product challenge
The hard part is not enabling WebAuthn. The hard part is rollout across a fragmented device and habit landscape.
Teams in India have to deal with:
- entrenched OTP behavior across banking and government journeys
- user confusion between biometrics, Aadhaar face auth, and actual passkeys
- legacy integration cost in banks and public-sector systems
- device diversity and fallback needs for users without modern passkey-ready setups
That is why passkey projects in India should be treated as adoption and migration work, not just feature delivery.
Read the full breakdown.
Top comments (0)