Insurance Customer Portal Passkeys Guide

1. Introduction#

Insurance customer portals are under pressure from multiple directions at once. Account takeover risk is rising, SMS OTP is expensive at scale, call centers absorb the fallout from password and MFA failures and regulators increasingly expect phishing-resistant MFA. That combination makes insurance one of the clearest customer authentication use cases for passkeys.

This article covers:

1. Why insurance portals are a strong passkey use case ATO risk, expensive OTP flows, delayed fraud detection and growing regulatory pressure.
2. How passkeys compare to legacy authentication methods SMS OTP, email OTP, TOTP and device trust across security, UX, compliance and cost.
3. What makes insurer rollouts different Legacy CIAM, multi-brand portal architecture, agent vs. policyholder flows and regional regulation.
4. How insurers can roll out passkeys with a practical operating model What to measure, how to use the maturity model and how to move from OTP-heavy logins to phishing-resistant MFA.
5. How passkeys drive digital adoption and self-service migration The strategic case for C-level and VP-level leaders: channel shift, call-center deflection and connecting authentication observability to business outcomes.

2. Why are insurance customer portals a prime target for account takeover?#

Insurance customer portals hold some of the most sensitive personal data out there while often relying on weak login security. That makes them a natural target for credential-based attacks. Policyholder accounts contain Social Security numbers, banking details, health records and claims history. All of this can be monetized through identity theft or fraudulent claims.

Unlike banking portals where transaction monitoring catches fraud in real time, insurance fraud often takes weeks or months to surface. An attacker who gains access to a policyholder account can change beneficiaries, file fraudulent claims, or exfiltrate personal data long before the insurer detects the compromise.

The scale of the problem:

• Credential stuffing at the front door: NYDFS fined eight auto insurers a combined USD 19 million in October 2025 specifically because they failed to enforce MFA on public-facing quoting systems. Attackers used credential stuffing to access sensitive driver data en masse.
• SMS OTP is expensive and fragile: At insurer scale (millions of policyholders), SMS OTP delivery costs compound quickly. A carrier sending 10 million OTPs per month at USD 0.03 per message spends USD 3.6 million annually, and that assumes 100% delivery. In practice, carrier filtering, number porting and international roaming cause 5-15% of OTPs to never arrive, each failed delivery potentially generating a support call.
• Call-center load from password resets: Insurance call centers already handle complex claims and policy inquiries. Adding password resets and MFA troubleshooting to this mix diverts agent time from revenue-generating activities. Industry estimates place authentication-related calls at 20-40% of total call-center volume for consumer financial services.
• Regulatory pressure is tightening: Beyond NYDFS, the FTC Safeguards Rule has mandated MFA for non-bank financial institutions since June 2023, and the NAIC Insurance Data Security Model Law (adopted in 25+ states) requires risk-based MFA for all licensees.

High-value data, delayed fraud detection, rising OTP costs and tightening regulation all point in the same direction: insurance portals urgently need phishing-resistant authentication.

3. How do passkeys compare to SMS OTP, email OTP, TOTP and device trust for insurance portals?#

Picking the right authentication method means weighing security, user experience, recovery, rollout complexity, support burden, compliance posture and cost at scale. The table below breaks down how each option stacks up.

Bottom line: Passkeys are the only option that scores highest across security, UX, support burden, compliance and cost at scale. The trade-off is rollout complexity, but that is a one-time investment that pays for itself as adoption grows.

4. What makes passkey rollout different for insurers?#

Deploying passkeys in insurance is not the same as deploying them in banking or SaaS. Insurers deal with legacy infrastructure, multi-brand complexity, divergent user populations and layered regulatory requirements that shape every implementation decision.

4.1 Legacy CIAM platforms#

Most large insurers run their consumer identity on enterprise CIAM platforms like Ping Identity, ForgeRock or Okta. These platforms now support FIDO2/WebAuthn at the protocol level, but that support only covers the backend ceremony. The adoption layer (enrollment nudges, device-aware prompts, error handling and client-side telemetry) is either missing or requires significant custom development.

This creates the same "1% trap" seen in banking deployments: the IdP checkbox is ticked, but adoption stagnates because no one built the product journey that moves policyholders from password to passkey.

4.2 Multi-brand portals and rpID strategy#

A typical large insurer operates auto, home, life and specialty products, often on separate subdomains or even separate domains acquired through M&A. Passkeys are origin-bound: a credential created on auto.insurer.com will not work on life.insurer.com unless both share the same Relying Party ID (rpID).

The fix:

• Define a single rpID anchored to the parent domain (e.g. insurergroup.com) before any passkey work begins.
• Route all authentication through a centralized SSO layer (OIDC/SAML) that uses this shared rpID.
• If legacy domains cannot be consolidated immediately, use Related Origins to bridge the gap without forcing re-enrollment.

4.3 Agent vs. policyholder flows#

Insurance has two very different user populations hitting the same backend systems:

Branch Insurance showed how this works in practice: they started with agents (higher frequency, more controlled environment) and hit 25% initial adoption before expanding to policyholders. Going agents-first built internal confidence and surfaced device-specific issues early on.

4.4 Regional compliance landscape#

Insurance authentication is not just a US regulatory issue. The exact rules differ by market, but the direction is consistent: stronger identity controls, broader MFA coverage and more scrutiny of customer-facing digital channels.

• US: NYDFS Part 500 mandates universal MFA by November 2025 for covered entities, including insurers licensed in New York. NYDFS explicitly flags SMS OTPs as weak and recommends phishing-resistant alternatives. The NAIC Insurance Data Security Model Law pushes risk-based MFA across 25+ states, while the FTC Safeguards Rule requires MFA for certain non-bank financial institutions and intermediaries.
• EU: DORA entered into application on 17 January 2025 and applies to insurance companies across the EU. DORA is broader than an MFA rule, but it raises the bar on ICT risk management, incident reporting, resilience testing and third-party oversight for customer-facing systems.
• Australia: APRA CPS 234 requires information security controls commensurate with risk across insurers and other APRA-regulated entities. APRA's 2023 MFA guidance specifically calls out strengthened authentication for privileged access, remote access and high-risk activities, and notes that material MFA gaps affecting policyholders can amount to a reportable security weakness.
• Canada: OSFI Guideline B-13 applies to federally regulated financial institutions, including insurers. OSFI says firms should implement risk-based identity and access controls, including MFA across external-facing channels and privileged accounts.

For multi-region insurers, the practical implication is simple: design customer authentication to satisfy the strictest applicable regime. The common direction is toward risk-based and increasingly phishing-resistant MFA, not continued dependence on SMS OTP.

5. What should insurers measure before and after launching passkeys?#

Launching passkeys without client-side telemetry is like writing an insurance policy without underwriting data. You will not know what is failing, where or for whom until your call center is overwhelmed. The "blind rollout" mistake from banking deployments applies just as much here, especially given the diverse policyholder demographics insurers deal with.

At a minimum, insurers should measure three business-facing outcomes:

• Login success rate: Are policyholders and agents completing sign-in more reliably after passkeys launch?
• Enrollment rate: Are users actually creating passkeys, or is adoption stalling after the first prompt?
• Fallback and support volume: Are users dropping back to SMS or password recovery, and are authentication-related support tickets going down?

If those three numbers move in the right direction, the rollout is working. If they do not, you need to adjust prompt timing, fallback design, device coverage or user education before scaling further.

5.1 Claims and account-change journeys matter more than generic logins#

Insurance portals are not just "log in and check balance" experiences. The highest-risk moments often happen when a policyholder files a claim, changes payout details, updates an address, adds a driver, changes a beneficiary or accesses sensitive documents. Those journeys should not be lumped into one generic login KPI.

Insurers should therefore track passkey performance separately for high-risk account events. If login success looks strong overall but claim-related or payout-related journeys still fall back to SMS or manual recovery, the rollout is not actually reducing operational risk where it matters most. This is one of the biggest differences between insurance and more frequently used consumer apps.

5.2 Low-frequency logins change the adoption playbook#

Many policyholders log in only a few times per year: at renewal, after a billing issue or when filing a claim. That makes passkey adoption in insurance fundamentally different from daily-use products. You have fewer opportunities to prompt, educate and recover from a bad first experience.

That is why insurers should measure enrollment by journey, not just in aggregate. A prompt shown after a successful payment or claim-status check may convert far better than a cold prompt on the first login screen months after the last session. In insurance, the best adoption moments are usually tied to trust and task completion, not login frequency.

6. What is the Insurance Authentication Maturity Model?#

This four-level framework gives insurers a way to benchmark where they stand today on authentication, set target milestones and communicate progress to boards, regulators and auditors. Each level builds on the previous one.

The following diagram visualizes the four maturity levels as a progression from SMS-only to full observability.

How to use this model:

1. Assess: Identify your current level by auditing auth methods, telemetry coverage and compliance gaps across all customer-facing portals.
2. Target: Set a 12-18 month roadmap to reach at least Level 3. Insurers under NYDFS oversight should target Level 4 to support the dual CEO/CISO certification requirement.
3. Communicate: Use the model in board presentations and regulatory submissions to demonstrate structured progress rather than ad hoc improvements.

7. How passkeys drive digital adoption and self-service migration#

Most insurance executives treat authentication as an IT concern. That is a mistake. For C-level and VP-level leaders whose strategic agenda includes shifting policyholders from call centers and branches to digital self-service, authentication is the single biggest friction point standing in the way.

7.1 Authentication is the front door to every digital initiative#

Every digital insurance initiative - self-service claims, online policy changes, digital payments, e-signature workflows - starts with a login. If policyholders cannot get past that front door reliably, none of the downstream investment delivers ROI.

The data is clear:

• 43% of consumers say managing logins impacts their willingness to use online services at all.
• 64% have abandoned a purchase because they had to create an account or could not log in.
• 60% of consumers find insurance, pension and mortgage portals difficult to navigate, with login being the first and most common failure point.
• Only 20% of insurance customers say digital channels are their preferred way of interacting with their insurer, largely because the experience - starting with authentication - is worse than what they get from banking and retail apps.

The following diagram illustrates how these four data points combine into a single adoption-blocking pattern.

For insurers spending millions on portal redesigns, chatbots and digital claims workflows, a password-and-SMS-OTP login experience undermines the entire investment. Policyholders who fail to log in or give up in frustration default to calling the contact center or visiting a branch - exactly the high-cost channels the digital strategy was supposed to replace.

7.2 Quantifying the self-service shift#

Moving policyholders from human-assisted channels to digital self-service is one of the highest-leverage cost reduction strategies in insurance:

• Phone interactions cost USD 8-15 per contact versus under USD 1 for self-service. At insurer scale, even a 10% channel shift from phone to digital saves millions annually.
• Portal users are 12% less likely to cancel their policies compared to non-portal users. Multi-channel users show a 25% higher retention rate.
• Insurers deploying digital self-service report 15-25% service cost reductions and 30% lower claims processing costs.
• 82% of insurance customers want to resolve issues without calling, but only 56% report adequate self-service tools - a gap that authentication friction widens further.

The chart below shows how these economics compare across channels.

Passkeys directly address the gap between customer intent and actual portal usage. When login takes under 2 seconds with a biometric confirmation instead of a password-plus-OTP flow that fails 5-15% of the time, more policyholders complete the digital journey instead of picking up the phone.

7.3 What Corbado's observability uniquely reveals about digital adoption#

Most insurers know their digital adoption rate is lower than they want. What they cannot answer is why. Is it device incompatibility? Enrollment flow friction? A specific OS or browser where passkeys fail silently? A demographic segment that never gets prompted?

This is where Corbado's authentication observability provides something no other tool on the market offers: the ability to connect authentication telemetry directly to business metrics like digital adoption rate, self-service completion rate and channel migration.

Corbado surfaces:

• Where policyholders drop out of the authentication funnel - not just "login failed" but which ceremony stage, on which device, for which user segment.
• Which cohorts are stuck on legacy methods - e.g. policyholders over 60 on Android who never see a passkey prompt because their device is incompatible, silently routing them to SMS and then to the call center.
• The direct link between authentication success and digital engagement - if login success rate increases by 10 percentage points, how much does portal self-service usage increase? How many fewer calls hit the contact center?

For a CIO or SVP of Digital presenting to the board, this turns "we launched passkeys" into "passkeys increased digital self-service adoption by X%, reduced call-center volume by Y% and saved USD Z per quarter." That is the strategic narrative that justifies the investment and accelerates the broader digital transformation roadmap.

8. How Corbado helps insurers deploy passkeys#

Most insurers already have a CIAM platform (Ping, ForgeRock, Okta) that can handle the WebAuthn ceremony. What they lack is the adoption layer that turns "we support passkeys" into "50% of our policyholders use passkeys." Corbado provides that layer.

8.1 Adoption engine#

Corbado's pre-built UI components and decision logic handle the enrollment journey that CIAM platforms leave to custom development:

• Contextual enrollment prompts surface at high-trust moments (immediately after a successful MFA check) rather than buried in account settings.
• Progressive urgency moves from "Optional" nudges to "Recommended" to "Mandatory" over a configurable timeline, matching the 12-18 month adoption curve most insurers need.
• A/B testing for enrollment messaging, timing and placement to optimize conversion rates across different policyholder segments and product lines.

8.2 Device intelligence#

Corbado maintains a continuously updated matrix of device-level passkey compatibility:

• If a specific Samsung model has a broken passkey implementation, Corbado suppresses the prompt automatically, routing the user to a fallback without frustration.
• Passkey Intelligence detects device capabilities before prompting, preventing the "Operation Interrupted" errors that cause support spikes.
• Insurance-specific device diversity (older tablets used by retirees, shared agency workstations, corporate-managed laptops) is handled through configurable trust policies.

8.3 Smart fallbacks#

Corbado prevents permanent lockouts by intelligently routing users to alternatives when their device or environment is not passkey-ready:

• Policyholders on incompatible devices see a smooth transition to the next-best method rather than an error screen.
• Recovery flows using identity proofing (eKYC, ID scan + liveness) allow re-enrollment without call-center intervention.
• Agent-specific fallback policies accommodate shared workstations and corporate proxy environments that block hybrid (QR code) flows.

8.4 Forensic telemetry#

Corbado provides the "X-Ray vision" that server-side CIAM logs cannot:

• Device Trust dashboard surfaces success rates by passkey type, device classification and SCA factor coverage.
• Real-time anomaly detection flags unusual patterns (shared device spikes, enrollment from suspicious environments) before they become security incidents.
• Audit-ready reporting gives CISOs the data needed for NYDFS annual certification, NAIC examinations and internal board reporting.

Corbado does not replace your existing CIAM stack. It sits in front of it, handling the real-world complexity of device fragmentation, user education and operational visibility that determines whether your passkey investment delivers ROI or stalls at under 1% adoption.

9. Conclusion#

Insurance customer portals are under pressure from multiple directions at once: rising ATO attacks, costly SMS OTP infrastructure, call-center overload from password resets, tightening regulatory expectations across the US, EU, Australia and Canada - and a strategic mandate to shift policyholders from high-cost human channels to digital self-service. Passkeys address all five by eliminating phishable credentials, removing per-authentication costs, reducing support burden, aligning with the shift toward stronger MFA and removing the login friction that blocks digital adoption.

Aflac (500,000 enrollments, 96% success rate), Branch Insurance (50% ticket reduction) and HealthEquity (mandatory rollout with no opt-out) have already proven that adoption at scale works. The key is treating passkeys as a product journey rather than an infrastructure checkbox: invest in enrollment flows, instrument the client, plan fallbacks and build the telemetry that connects authentication performance to the business metrics your board actually cares about - digital adoption rate, call-center deflection and self-service completion.

Use the Insurance Authentication Maturity Model to benchmark your current posture, set a 12-18 month target and communicate structured progress to your board and regulators.

About Corbado

Corbado is the Passkey Intelligence Platform for CIAM teams running consumer authentication at scale. We help you see what IDP logs and generic analytics tools can't: which devices, OS versions, browsers and credential managers support passkeys, why enrollments don't turn into logins, where the WebAuthn flow fails and when an OS / browser update silently breaks login, all without replacing Okta, Auth0, Ping, Cognito or your in-house IDP. Two products: Corbado Observe layers observability for passkeys and any other login method. Corbado Connect adds managed passkeys with analytics built in (alongside your IDP). VicRoads runs passkeys for 5M+ users with Corbado (+80% passkey activation). Talk to a Passkey Expert →

Frequently Asked Questions#

How do passkeys reduce account takeover risk for insurance customer portals?#

Passkeys use public-private key cryptography bound to the insurer's domain, making them immune to phishing, credential stuffing and SIM-swapping attacks that plague password and SMS OTP flows. Aflac reported a 96% login success rate after deploying passkeys, and Branch Insurance saw support tickets drop by roughly 50%. Because no shared secret is transmitted during authentication, attackers cannot harvest reusable credentials even if they control the network.

What compliance frameworks shape authentication requirements for insurance customer portals and how do passkeys help?#

In the US, NYDFS Part 500, the FTC Safeguards Rule and the NAIC Insurance Data Security Model Law all push insurers toward stronger MFA. Outside the US, EU insurers fall under DORA, Australian insurers under APRA CPS 234 and Canadian insurers under OSFI Guideline B-13, all of which raise expectations around authentication controls for customer-facing systems. Passkeys help because they provide phishing-resistant MFA using FIDO2/WebAuthn cryptographic credentials while reducing dependence on weaker SMS OTP flows.

How do passkeys compare to SMS OTP, TOTP and device trust for insurance portal authentication?#

SMS OTP costs USD 0.01-0.05 per message at scale, is vulnerable to SIM-swapping and phishing and generates high call-center load from delivery failures. TOTP apps eliminate per-message cost but remain phishable and require manual code entry. Device trust reduces friction on known devices but offers no phishing resistance. Passkeys combine phishing-resistant security with zero per-authentication cost and sub-2-second login times, making them the only method that scores highest across security, UX, cost and compliance dimensions.

What makes passkey rollout different for insurers compared to banks or SaaS companies?#

Insurers face multi-brand portal complexity where auto, home and life products may run on separate subdomains requiring a unified rpID strategy. Legacy CIAM platforms like Ping, ForgeRock or Okta handle backend WebAuthn but offer limited adoption tooling. Agent versus policyholder flows require different trust levels and device profiles. Regulatory pressure also spans multiple jurisdictions: US insurers face NYDFS Part 500, NAIC Model Law and FTC Safeguards Rule, EU insurers fall under DORA, Australian insurers answer to APRA CPS 234 and Canadian insurers to OSFI Guideline B-13. That requires a rollout plan that satisfies the strictest applicable standard.

What is the Insurance Authentication Maturity Model and how can insurers use it to benchmark their progress?#

The Insurance Authentication Maturity Model defines four levels: Level 1 (SMS-only) with single-factor OTP and no phishing resistance; Level 2 (MFA-enabled) with password plus SMS or TOTP meeting basic compliance; Level 3 (phishing-resistant) with passkeys deployed, enrollment secured and smart fallbacks; Level 4 (phishing-resistant + observability) with full telemetry, device trust and continuous monitoring. Insurers can use the model to identify their current level, set target milestones and communicate progress to boards and regulators.