Which Insurances offer Passkeys?

Passkeys in insurance are transforming how policyholders access their accounts and sensitive information securely without passwords. In regions like the USA, Europe, Australia, and Asia, the first insurance providers are beginning to explore or implement passkeys to enhance security, reduce the risk of account takeover, and improve the digital customer experience. This article covers which insurance providers currently support passkeys and why passkeys represent the future of online insurance authentication.Passkeys are a secure, passwordless authentication method based on the FIDO2 and WebAuthn standards. They offer a faster and safer way for users to access their insurance accounts by replacing traditional passwords with biometric authentication (like fingerprint or facial recognition) or a device-based credential (like a PIN or screen lock pattern). Currently, Aflac and Branch Insurance are notable examples of major US insurer that have implemented passkeys for customer login. Many other providers are likely in various stages of evaluation or development, or still rely on traditional methods. These institutions are looking towards passkeys to bolster security against phishing, reduce operational friction, and provide a more seamless user journey.

• Passkeys in insurance prevent phishing and fraud: Passkeys eliminate phishing and password-related breaches, as they are phishing-resistant and prevent attacks such as credential stuffing or account takeovers.

• Better user experience in the checkout, login and sign-up process: The quick and simple login and sign-up process with biometrics (e.g., Face ID, Touch ID, Windows Hello, Android Biometrics) is something that users are already familiar with. For many implementations, no additional app or extra hardware device needs to be purchased, which makes things easier for the user.

• Passkeys reduce operational costs for insurances: Passkeys reduce providers’ reliance on costly SMS-based 2FA methods or other operational costs in the customer support or IT support team (e.g., to recover accounts or help on password / MFA resets). Moreover, the reduction of fraud by passkeys helps to prevent costly cases where customers might be scammed.

---

Insurance providers are increasingly looking towards passkeys to address escalating cybersecurity threats and meet policyholder demands for secure, convenient digital experiences. Traditional authentication methods, primarily passwords often combined with SMS or email-based 2FA, remain vulnerable to sophisticated phishing attacks, social engineering, credential stuffing, and SIM-swapping, putting sensitive policyholder data and financial information at risk. Passkeys directly address these vulnerabilities by leveraging the robust security of FIDO2 / WebAuthn standards, which utilize public-private key cryptography, ensuring that no shared secrets are transmitted or stored in a way that can be easily compromised. The potential for significant cost savings and improved customer engagement further strengthens the business case for adoption.

• Phishing Resistance: Passkeys authenticate users without sharing secrets over the network; they are bound to specific domains, preventing use on fraudulent sites.

• Support across devices: Passkeys in insurance applications ensure seamless access for users across multiple devices. Whether you’re using Face ID on iPhone, Windows Hello on a laptop, or Android biometrics, passkeys can sync through iCloud Keychain or Google Password Manager, making online insurance logins effortless.

• Improved User Experience (UX): Passkeys provide a frictionless and secure login experience, significantly reducing login abandonment rates and enhancing user satisfaction when accessing insurance services.

In the following, you’ll see an overview of which insurance companies use passkeys to protect their users.

While overall adoption for customer accounts seems nascent, some leading US insurers are making moves.

Yes! Aflac has implemented passkeys and was reportedly the first major US insurance company to do so. They partnered with Transmit Security for their passkey initiative.

Key highlights:

• Early Adoption: Aflac is recognized as an early adopter in the insurance sector.

• Significant Uptake: Reports indicate rapid user adoption shortly after launch, with over 500,000 customers enrolling a passkey. This resulted in high login success rates (96%) and a reduction in login-related issues.

• Availability: Passkeys are available as a login method for Aflac customers. Their MyAflac® mobile app also supports biometric login

Yes! Branch Insurance supports passkeys, having implemented them to enhance security and user experience, particularly for their network of independent insurance agents.

Key highlights:

• Motivation: Branch adopted passkeys to overcome challenges with traditional SMS-based two-factor authentication (which is vulnerable to phishing and SIM swapping) and to reduce the high volume of customer support tickets related to password resets and login issues for their agents.

• Partnership & Rollout: They partnered with authentication provider Descope for the implementation. The rollout followed a phased approach, starting with internal testing to build confidence, followed by a gradual migration for their agent base, beginning with small groups and scaling up. Agents were prompted to set up passkeys, with email/OTP available as a fallback.

• Results: The implementation led to a significant drop in support ticket volume by about half. Branch also observed surprisingly high device compatibility, with very few agent devices unable to support passkeys. Initial adoption among agents reached 25%, with plans to increase this through further user education.

• Focus: The available information primarily details the rollout for Branch's independent agents. Details on availability or plans for end-customer/policyholder passkey login are not specified in the reviewed materials.

State Farm's passkey implementation appears to be in development or limited rollout. While information describing passkeys and their benefits exists on State Farm's login and help pages , indicating technical work has been done, there is currently no widely visible option to "Sign in with passkey" on the main login screen, nor have there been broad public announcements regarding full availability.

Currently, Geico does not appear to offer passkey support for customer login. Their system relies on traditional User IDs and passwords. Some third-party sources indicate users are requesting this feature.

Progressive does not currently offer passkeys based on the FIDO/WebAuthn standard for general account login. They use User IDs and passwords. While their mobile app supports biometric login (fingerprint/face recognition), it's not explicitly confirmed if this uses the passkey standard or is an app-specific feature.

Allstate does not currently support passkey authentication for customer accounts. They utilize User IDs, passwords, and sometimes require an additional verification code sent via text or email as an extra security layer.

Passkey adoption among major Australian insurance providers for customer login appears limited at this time.

There is no indication that IAG currently offers passkeys for customer login. Their password reset process involves helpdesk intervention, and their developer portal focuses on standard registration methods.

Suncorp does not currently support passkeys for customer login. Their online banking access relies on Customer IDs, passwords, and SMS verification codes for certain actions like password resets.

European insurance providers seem to be cautious regarding customer-facing passkey implementation, potentially focusing on traditional MFA methods.

Allianz does not currently support passkeys for general customer login. They employ MFA methods, including authenticator apps requiring QR code scanning for access. Third-party sites show user interest in Allianz adopting passkeys.

AXA does not appear to offer passkey support for customer login. Their online systems use standard email-based password reset mechanisms.

Generali does not currently support passkeys for customer login, based on information regarding their MyGenerali portal in Malaysia. Access relies on User ID and password, with standard email-based password recovery.

Zurich Insurance does not currently support passkeys for customer login. Their system uses usernames (email addresses) and passwords, supplemented by two-factor authentication via SMS or automated voice message codes.

HUK-Coburg does not appear to offer passkey support. Their online interactions involve standard email-based password resets.

No information was found indicating Debeka offers passkey support.

Major Asian insurance providers reviewed do not seem to have implemented customer-facing passkeys yet.

Ping An does not currently offer passkeys for customer login. Their focus seems to be on broader "finance + technology" initiatives and mobile SDK security rather than passkey authentication for end-users.

China Life Insurance does not currently support passkeys for customer login. Their online access uses Login IDs, passwords, and verification codes, with security information focusing on TLS encryption and firewalls.

While some insurance platforms might support hardware security keys like YubiKeys, their use is typically focused on securing internal employee or agent access rather than widespread customer login. They often serve as a phishing-resistant two-factor authentication (2FA) method alongside a password, or as part of a broader enterprise security strategy.

Key insights:

• Universal support for hardware keys as the primary login method for insurance customers is not common.

• FIDO-based passwordless login (passkeys), which can be implemented using device biometrics or PINs, is gaining momentum and is generally seen as more user-friendly for consumers than requiring a separate physical key.

• Hardware keys remain a strong option for high-security scenarios, often used as an additional security layer or for specific user groups like privileged administrators or agents handling sensitive data.

Insurance providers globally are increasingly evaluating passwordless authentication methods like passkeys due to the significant risks associated with traditional passwords. Phishing, social engineering, credential stuffing, and the rise of AI-powered attacks make password-based security increasingly inadequate for protecting sensitive policyholder information and financial data.

The shift away from passwords in the insurance sector will likely occur in phases, reflecting a cautious approach and the need to manage diverse customer needs and legacy systems :

1. Current state: A predominantly hybrid model where insurers rely on passwords, often supplemented with traditional MFA (like SMS/email OTPs or authenticator apps), while exploring or beginning limited rollouts of passkeys. State Farm represents an early move beyond this.

2. Near future: Gradual increase in passkey offerings, likely starting as an optional alternative login method. Focus may initially be on mobile app users or specific customer segments.

3. Long-term goal: A fully passwordless insurance experience for both consumer policyholders and potentially business/agent portals, driven by security imperatives, cost savings, and improved user experience.

For consumer policyholders, passkeys offer a highly scalable and user-friendly path to passwordless authentication. Unlike some security methods, passkeys often:

✅ Do not require users to purchase additional hardware.

✅ Are built into the smartphones and computers users already own.

✅ Can work across platforms (iOS, Android, Windows), leveraging synced passkeys via cloud ecosystems (though some friction exists).

✅ Provide a fast, familiar, and frictionless login experience using device unlock methods.

Given these advantages, passkeys are poised to become the preferred standard for securing consumer insurance accounts, balancing robust security with necessary convenience.

The adoption of passwordless authentication for business clients or insurance agent portals might proceed at a different pace compared to consumer accounts. Factors influencing this include:

• Potentially stricter compliance or regulatory requirements demanding specific verification layers.

• Existing corporate IT security policies and established authentication methods within agent networks or business clients' organizations.

• The need for integration with diverse B2B systems, agency management platforms, and internal workflows.

While enterprise passkeys are becoming more common , adoption within the insurance B2B/agent context may be more gradual and tailored to specific operational needs and security postures.

The insurance industry is moving towards passwordless authentication as a necessary evolution in security and customer service. Insurance passkeys provide:

• Phishing resistance: Fundamentally mitigating risks from credential theft and account takeovers.

• Faster login times: Improving policyholder experience and reducing friction in accessing digital services.

• Cost savings: Reducing operational expenses tied to SMS OTPs, password resets, and fraud remediation.

• Improved User Experience (UX): Offering a seamless authentication process that can boost digital engagement and reduce abandonment during critical interactions like quotes or claims.

• Industry alignment & Compliance: Following FIDO standards for security and potentially helping meet evolving regulatory requirements or cyber insurance prerequisites.

As passkey adoption grows across the digital landscape, policyholders will increasingly expect this level of security and convenience from their insurance providers. Embracing passkeys allows insurers to meet these expectations while significantly strengthening their security posture.