Are passkeys accepted for PCI DSS multi-factor authentication?

Passkeys and hardware security keys based on FIDO2 and WebAuthn are phishing-resistant, and they can count as multi-factor when the device verifies a PIN or biometric before the private key is used. The operator should document how its chosen method meets the requirement, since assessors look at how each factor is verified.

What passkeys are

Passkeys are credentials based on FIDO2 and WebAuthn. The private key stays on the user's device or in a hardware security key; the service holds only the public key. Authentication requires the device, and the device requires a PIN or a biometric before using the key. Phishing cannot capture the credential, because it is bound to the site's origin.

How they map to MFA

• Something you have: the device or security key holding the private key.
• Something you know or are: the PIN or biometric that unlocks it.
• PCI DSS requires at least two independent factors; a passkey with user verification provides them in one gesture.

What assessors look for

Evidence that user verification is enforced, so a passkey cannot be used without the PIN or biometric, and that the implementation follows the standard. The operator should document the chosen method, the verification setting and how it meets the requirement for each account type. Passkeys also solve the password policy debate: there is no password to rotate or measure. For a merchant console, offering passkeys next to authenticator apps gives users a phishing-resistant option without a hardware rollout.