MoneySquare launches passkey login as security firms warn of Google Password Manager exploits

Japanese fintech MoneySquare announced it will introduce passkey authentication for customer logins on 1 August 2026, following Financial Services Agency guidelines and the Japan Securities Association’s standards. The new method uses biometric or device‑based verification, eliminating passwords and aiming to reduce phishing and unauthorized access. Email‑based authentication will remain available for certain procedures during a transition period.

Separately, security research team Unit 42 reported a novel attack called “Pass‑ta‑key” that can bypass passkey authentication by exploiting Google Password Manager on compromised Windows PCs. The technique mimics Chrome’s authentication flow, allowing logins without fingerprint or PIN verification. Tests showed success on eBay but not on GitHub. Google has patched a logging issue related to the attack, though risks remain during device re‑registration. Researchers advise updating operating systems and browsers, avoiding malware, and that service providers add extra verification steps for passkey logins.