SINGAPORE – A new mode of national authentication initially rolled out to iPhone users has now been extended to Android phone users.National authentication system Singpass’ new passkey feature aims to foil phishing scams that have led to millions in losses by ensuring access is granted only to legitimate websites.It works through a unique pair of encryption keys – one residing on the user’s phone and the other on Singpass’ backend server – for every website that is integrated with the national authentication system.Thus, a user’s passkey cannot be shared or exploited, unlike passwords or QR codes, and will not work on fake websites.Android users will receive reminders to create passkeys via notifications from the Singpass app starting on Sept 9, the Government Technology Agency of Singapore (GovTech) said in a statement.Around 800,000 iPhone users have created their passkeys since the initial roll-out in July, it added.GovTech operates Singpass, which supports 5.5 million users and is integrated with more than 1,400 government agencies and private-sector services. These include the digital health portal HealthHub, the Inland Revenue Authority of Singapore’s tax portal, the Central Provident Fund Board, DBS Bank and Singtel.A one-time registration is needed to use passkey authentication.Android users need to update their Singpass app, tap the “create passkey” banner and follow the on-screen instructions provided to enable passkeys.Once a pair of unique passkeys is registered with Singpass, users can log in to websites that accept Singpass verification by scanning their face or fingerprint in the Singpass app. Users who have not set up biometric authentication can enter their six-digit passcode in the app.Singpass’ backend system will verify the private key stored on a user’s device against the public key registered in the system to validate every login.Users need not register separate pairs of encryption keys for every website.Laptops and desktops currently do not support the Singpass passkey feature. GovTech, however, said the feature will be extended to desktop users by the end of 2026.Singpass passkeys comply with open standards developed by the Fast IDentity Online (FIDO) Alliance, an industry association comprising more than 250 members. They include tech firms such as Microsoft, Google and Apple, as well as government bodies in Australia, Britain and the US.Many online services, including those from Apple, Google, Microsoft and Adobe, already offer FIDO passkey authentication, in addition to traditional passwords and two-factor authentication.The number of phishing cases in Singapore fell to 3,104 in the first half of 2026, from 3,772 in the same period in 2025. Monetary losses suffered by victims of phishing scams also fell, from $30 million to $9.6 million.