SINGAPORE, 5 AUG 2026 — Singpass, the national digital identity app, began supporting passkeys on 1 July. This improves how Singaporeans log in, but it addresses the smaller part of the scam problem the government has spent three years trying to solve.
Passkeys replace the shared secret. Instead of a password or a scannable code that a fraudulent site can capture and replay, the app holds one half of a cryptographic key pair and the Singpass system holds the other. The browser will only complete the exchange with the site the key was registered to. A copy of the login page on a different domain cannot obtain anything reusable, because there is nothing reusable to obtain.
We published an explainer on what passkeys actually replace earlier this year. The mechanism is sound and follows the direction of the industry; applying it to a national identity system used for tax, banking, and health records is the right call.
What it fixes
The attack passkeys close is credential theft: the fake login page, the intercepted one-time code, the harvested QR scan. GovTech's description of the rollout puts the emphasis exactly there — the design prevents fraudulent sites from stealing or misusing credentials such as passwords or QR codes.
The concern is not hypothetical for Singpass. Credential-stuffing against the system has been an issue before, and a national identity credential is the highest-value login most citizens have. Removing the phishable secret from it eliminates an entire category of attack rather than making it harder.
The rollout is staged: iPhone users could register from 1 July, with Android support to follow.
What it does not fix, and the number that shows why
The Singapore Police Force's Annual Scam and Cybercrime Brief for 2025 records that 81.8 per cent of reported scams that year involved self-effected transfers. In those cases the scammer never obtains control of the victim's account. The victim is deceived into performing the transaction themselves.
| Does a passkey help? | Why | |
|---|---|---|
| Fake login page harvesting a password | Yes | Nothing reusable is exchanged |
| Intercepted one-time code or QR scan | Yes | No shared secret to intercept |
| Credential stuffing from an old breach | Yes | There is no password to reuse |
| Victim persuaded to transfer money themselves | No | The login is genuine and so is the person |
| Victim coached through a real approval screen | No | Authentication succeeded as designed |
RECATOOLS assessment of what the mechanism addresses. The self-effected transfer share is the Singapore Police Force's, from its Annual Scam and Cybercrime Brief 2025.
A passkey answers the question "is this the right person at the right site?" with far more confidence than a password ever could. It has nothing to say about whether that person is on the phone to someone impersonating a bank officer while they approve the transfer.
This is not a criticism of passkeys, which solve the problem they were designed for. It is a caution about how this improvement is described. Authentication technology has been the visible front of anti-scam policy for years because it is tractable and shippable. The dominant loss mechanism in Singapore is not an authentication failure at all.
There is direct precedent for why this particular system needed it. Singpass has been the target of credential-stuffing before — attackers replaying username and password pairs harvested from unrelated breaches, on the assumption that people reuse them. That attack works only against a shared secret. Against a passkey it does not work at all: there is no password stored anywhere to steal from another service, and nothing a stuffing tool could replay. This control removes an entire category of attack rather than just making it harder.
The trend passkeys are joining
Singapore's scam figures were already moving in the right direction before this shipped, which matters for how the rollout should be judged later.
The 2025 brief records 37,308 scam cases, down 27.6 per cent from 51,501, and losses of about S$913.1 million, down 17.9 per cent on 2024. It is the first decline in the series. But the two percentages are not the same size: cases fell further than money did, so the average loss per case rose. Fewer victims, each losing more.
That is the pattern a hardening authentication layer would be expected to accelerate. High-volume, low-value credential attacks are the ones technical controls remove most efficiently. What survives is the labour-intensive, high-value deception — the fake official, the investment relationship built over weeks — which costs the attacker more per victim and therefore has to extract more from each one.
After a successful passkey rollout, expect case counts to keep falling, the average loss per case to keep rising, and total losses to fall by less than the case numbers suggest. Anyone reading a future press release should check which of the three is being quoted.
Where the two halves meet
There is a real interaction, and it runs the other way from the intuitive one.
As authentication hardens, the economics push attackers further towards social engineering, because the technical route closes. A country that successfully eliminates credential theft should expect the self-effected share of its scam losses to rise, not fall — not because deception is growing but because the alternative is shrinking. The share is already above four in five.
That means the metric to watch after this rollout is not the proportion of scams involving stolen credentials, which should fall and will be reported as a success. It is total losses, which depend on a category passkeys do not touch. We reported on 3 August on the fortnightly enforcement sweeps that are the current response to that category, and on the annual figures showing cases falling while the average loss per case rises.
The unglamorous part is the rollout
For most users the practical question is narrower than any of this: when does it reach my phone, and will I notice?
Passkeys are among the few security improvements that make the daily experience better rather than worse — no password to recall, no code to copy across from a message, and the device biometric doing the work. The barrier is never user resistance once it is available. It is availability. And because registration is a choice rather than a migration, some proportion of users will simply never do it, which means the older login path has to be maintained and defended for as long as anyone is still on it.
The design moves a risk rather than removing it. A passkey is bound to a device, so losing the phone becomes an identity problem rather than an inconvenience, and account recovery turns into the weakest remaining path into the account. Every phishing-resistant system inherits this: whatever process restores access to someone who has genuinely lost their device is also the process an attacker will target, because it is the only one left that accepts human judgement as input.
The Android timeline, on which the announcement is least specific, will determine how much of this benefit is realised. Until it ships, the strongest login Singapore offers its citizens is one that a substantial share of them cannot use. That is a sequencing decision rather than a flaw, and it is worth naming, because a security control that half the population cannot yet enable protects half the population.
View author profile → · Editorial policy
