Securing Digital Identity
The Government Technology Agency of Singapore (GovTech) has officially extended its “passkey” authentication feature to Android devices, a significant step in the agency’s effort to neutralize phishing threats. Starting September 9, 2026, Android users across the nation can register device-bound encryption keys within the Singpass app, effectively replacing traditional password-based logins and one-time passwords (OTPs) for integrated services.
This rollout follows an initial release for iPhone users in late June 2026, which saw approximately 800,000 users adopt the technology within its first two months. According to The Straits Times, GovTech plans to further broaden this capability to desktop and laptop users by the end of 2026.
How the Technology Works
The Singpass passkey system utilizes public-private key cryptography, adhering to open standards developed by the Fast IDentity Online (FIDO) Alliance. When a user registers a passkey, a unique pair of encryption keys is generated: a private key stored securely on the user’s smartphone and a corresponding public key registered on the Singpass backend server.
Because the private key is bound to the physical device and protected by biometric verification—such as facial recognition or fingerprint scanning—it cannot be shared or intercepted by malicious actors. When a user attempts to log in to a service, the system verifies the private key against the public key, ensuring that access is granted only to legitimate, authorized websites. As noted by AsiaOne, this mechanism renders traditional phishing attempts useless, as the passkey simply will not function on fraudulent or “spoofed” websites.
Impact on Cybersecurity Stakes
The transition to passkeys comes amid a concerted government effort to reduce monetary losses resulting from cybercrime. In the first half of 2026, the number of phishing cases in Singapore dropped to 3,104, down from 3,772 in the same period the previous year. More significantly, monetary losses attributed to these scams fell sharply from $30 million in the first half of 2025 to $9.6 million in the first half of 2026.
GovTech maintains that this shift does not compromise user convenience. The 5.5 million Singpass users, who access over 1,400 government and private-sector services—including the Inland Revenue Authority of Singapore (IRAS) and major financial institutions like DBS Bank—can continue to access their accounts seamlessly. Users are required to update their Singpass app to the latest version to access the “create passkey” banner, which guides them through the one-time registration process.