Passkeys are no longer a promise. In its 2026 report, the FIDO Alliance —the consortium behind passwordless authentication standards— estimates there are already 5 billion passkeys in use worldwide. That is excellent news for digital security. And far from replacing it, it reinforces the role of SMS within a well-designed authentication strategy.
What the FIDO Alliance report says
- 90% of consumers surveyed are aware of passkeys and 75% have enabled at least one.
- 49% use them regularly when available.
- 33% experienced an account compromise or received a breach notice in the past year.
- 47% are likely to abandon a purchase or sign-in if they cannot remember their password.
- 68% of organizations have deployed or are deploying passkeys for employee sign-in.
The study surveyed 11,000 consumers and 1,400 enterprise decision-makers in ten countries.
What a passkey is, in short
A passkey replaces the password with a cryptographic key stored on the user’s device, unlocked with the phone’s fingerprint, face or PIN. It cannot be guessed or reused on another site, and it resists phishing because it only works on the legitimate domain.
Why SMS is still part of the equation
Passkeys handle recurring sign-in very well, but there are moments when the user does not have one yet, or no longer has access to it. That is where SMS OTP fulfills functions that are still necessary:
- Sign-up and number verification. Before creating a passkey, the company needs to confirm that the customer’s phone is real and belongs to them.
- Account recovery. If the user changes or loses their phone, an SMS code to the registered number is one of the most common ways back in.
- Users without a compatible device. Not everyone has a recent device or the feature enabled; SMS works on any mobile phone.
- Confirming sensitive operations. Many organizations combine methods and require a second factor for high-risk actions, as we explain in SMS OTP, authenticator app or push.
How to get the best of both
The trend is not choosing one over the other but combining them: passkeys for daily access, SMS to verify, recover and back up. For SMS to do its part well, take care of three things: code messages without links and with a warning not to share them, short validity with an attempt limit, and a platform with real-time delivery reports so you know each code arrived. If you are comparing options, see how to choose an SMS OTP provider in Mexico.
At Grupo Tecnophone we deliver OTP codes for companies in Mexico on infrastructure built for critical messaging, with encryption and specialized support. If you want to try it with your own authentication flow, request a demo.
Sources
- “Five Billion Passkeys: FIDO Alliance Reports Mainstream Global Usage on World Passkey Day 2026”, FIDO Alliance, May 2026. Read article
- “The State of Passkeys 2026: Global Consumer and Workforce Report”, FIDO Alliance, 2026. Read article
