Zumigo InstaAuth Achieves FIDO2 Server Certification, Bringing Frictionless, Secure Passkey Sign-In to Banks, Fintechs, and Merchants

Full certification from the FIDO Alliance validates InstaAuth's phishing-resistant passkey authentication across real-world devices, available now in the Auth Widget and IDV Builder

SAN JOSE, Calif.--(BUSINESS WIRE)--Zumigo, Inc., a leader in mobile identity intelligence and fraud prevention, today announced that Zumigo InstaAuth has achieved Full FIDO2 Server Certification from the FIDO Alliance (Certificate No. FA001202600033). The certification brings independently validated, phishing-resistant passkey authentication to the Auth Widget in InstaAuth and IDV Builder, Zumigo's no-code identity verification platform, so businesses can offer customers a sign-in that is fast, familiar, and secure.

Sign-in is one of the most important moments in any digital relationship. It is where customers decide whether an experience feels effortless, and where businesses decide whether to trust who is on the other side. Passkeys let people sign in with the same Face ID, fingerprint, or Windows Hello they already use to unlock their devices, with no password friction and no OTP friction. Because each passkey is cryptographically bound to the users’ device and to the site it was created for, it is phishing-resistant by design: there is no shared secret for a fraudster to steal, or reuse on a look-alike site. With FIDO2 certification, Zumigo customers can offer that experience knowing it meets the standard the industry trusts.

Independently validated. FIDO2 Server Certification is the FIDO Alliance's formal conformance and interoperability testing program for the server side of passwordless authentication. It verifies that a server correctly implements the WebAuthn and CTAP2 protocols across the full range of real-world authenticators, from platform passkeys like Face ID, Windows Hello, and Android biometrics to roaming security keys, not just the handful a team happens to test. In authentication, precision matters: a small gap in attestation validation, signature verification, or origin binding is a security hole, not a minor bug. Certification gives customers, auditors, and partners a trusted third-party signal that the implementation is correct and secure, and it is fast becoming a baseline expectation for any business handling authentication at scale. InstaAuth was certified against the FIDO2 CTAP v2.1 specification after completing conformance testing in August and interoperability testing in September 2026.

Built for the moments that matter. For banks and credit unions, FIDO2-certified passkeys mean a familiar, secure sign-in customers can use every day. For fintechs, they mean quick, confident access that keeps people engaged from the very first login. For payment providers, they mean smooth authentication at the moments money moves. And for merchants, they mean returning shoppers can sign in and check out in seconds. A sign-in that takes a glance or a tap keeps more customers moving, so more visits turn into transactions.

Stronger together, simple to deploy. Businesses can now offer passkey sign-in through InstaAuth and pair with carrier-grade phone verification InstaAuth already provides. The two work better together. Using Silent Network Authentication (SNA) or SIM-based authentication (SBA), businesses can instantly confirm that a user controls the phone number on file, with no one-time codes to type, intercept, or phish. Once verified, the user can create a passkey in the same step and sign in with fingerprint or face scan from then on. Passkeys provide phishing-resistant everyday logins, while SNA and SBA remain available in the background to onboard new devices, recover accounts, and step up verification on high-risk actions. Teams can embed the Auth Widget in their existing login flow or add it through IDV Builder, with no passkey server to build, test, or certify.

Built for the AI era. Generative AI has made voices, faces, and login pages easy to fake, and AI-assisted phishing kits make convincing fake sites cheap to produce. Carrier verification and passkeys hold up because they rest on things AI cannot synthesize: the secret key includes a SIM, a live session on the carrier network, and a private key held on the customer’s own device. A passkey is bound to the website it was created for, so a look-alike page gets nothing usable from it, and carrier verification removes the one-time code attackers rely on stealing.

The same foundation matters as AI agents begin to log in, pay, and change settings on customers’ behalf. A carrier-verified phone number paired with a passkey gives businesses a strong anchor for that delegation, and SNA or SBA can serve as the step-up check when an agent attempts something high-risk, so sensitive requests are confirmed by the person they affect. And because the certification is independent, security, risk, and compliance teams have a recognized standard to share with auditors, partners, and regulators.

"At Zumigo, we're always looking out for our customers, and for theirs," said Chirag Bakshi, CEO of Zumigo. "Banks, fintechs, payment providers, and merchants know the best experiences feel effortless. Passkeys give their customers a sign-in that is both simple and secure, and FIDO2 certification means they can offer it with confidence." "Every login is a trade-off between security and conversion, and AI is raising the stakes on both,” said Harish Manepalli, CTO of Zumigo. “AI can fake a voice or a face, but it can't fake a SIM or a live carrier session. FIDO2 certification gives our customers independent assurance that InstaAuth's passkey server meets the standard. Paired with carrier-grade phone verification, they can onboard users in seconds and still protect accounts at the moment takeover is most likely. Less friction for good customers and fewer openings for fraudsters."

FIDO2-certified passkey authentication is available now in InstaAuth and IDV Builder. Zumigo will showcase IDV Builder at Money20/20 USA in Las Vegas this month at booth #7066.

To learn more or schedule a demo, visit zumigo.com/contact/.

About Zumigo

Zumigo powers digital identity verification in the world's largest enterprises to protect transactions, accounts and trust, using real-time intelligence across mobile, email, device, financial, account, and other information sources. Its modernized, multi-layer approach fortifies the identity perimeter against today's complex fraud and promises a streamlined consumer journey from onboarding to transactions. Zumigo supports over 800 mobile operators, verifying over 4.5 billion mobile numbers globally with services reaching 180 countries. Learn more at www.zumigo.com.

All trademarks are the property of their respective owners.