FIDO Alliance reports 5 billion active passkeys as deepfake fraud surges

The streaming industry faces a dual threat of account takeover via deepfake social engineering and the erosion of content trust through synthetic media. By shifting to passkeys, platforms can eliminate the phishable secrets that attackers target. Furthermore, as AI agents begin to act independently—with one-third of enterprises expected to use them by year-end—the focus must move toward short-lived, delegated identities rather than shared human credentials. This transition from 'how it looks' to 'where it came from' is no longer optional; it is now a regulatory mandate under the EU AI Act. Watch for the success rate of C2PA metadata persistence across social and streaming distribution platforms.

The transition to passwordless infrastructure is occurring against a backdrop of tightening global regulation and ballooning fraud costs. Per the European Commission, August 2, 2026, marked the formal enforcement date for Article 50 of the EU AI Act, which requires providers of generative AI systems to implement machine-readable watermarks and metadata. Non-compliance now carries potential fines of up to €15 million or 3% of global annual turnover. Similarly, California's SB 942, as amended by AB 853, set August 2, 2026, as the operative date for large AI providers to offer public detection tools and persistent watermarking for synthetic content.

Market data underscores the urgency of these technical shifts. Per Shufti’s 2026 Identity Fraud Index, deepfake-powered identity fraud is projected to surge 495% this year compared to 2025. This rise is particularly acute in the financial and technology sectors; for instance, a single deepfake impersonation of a corporate executive recently led to a record $25.6 million loss for the firm Arup, according to reporting from CrowdStrike in mid-2026. While human ability to spot fakes remains near zero, the FIDO Alliance notes that 75% of consumers have now enabled at least one passkey, providing a critical baseline for phishing resistance.

Enterprise security stacks are evolving to treat deepfake detection as a foundational layer rather than a niche tool. Per Biometric Update (August 2026), the market for deepfake detection is projected to double to 12.2 billion annual checks by 2028. To manage the 'agentic enterprise,' Okta launched dedicated identity lifecycles for AI agents in April 2026, aiming to move organizations away from the risky practice of allowing autonomous software to borrow human credentials. Currently, while 82% of organizations view a fully passwordless workforce as an ultimate goal, only 28% have reached that milestone, according to FIDO Alliance data.