Police Urge Passkey Adoption as Account Takeover Cybercrime Profits Surge

Law enforcement agencies are actively urging the public to adopt passkeys following a dramatic surge in cybercriminal profits derived from account takeover attacks. This recommendation comes in response to data indicating that the financial rewards for stealing user credentials have escalated significantly, making identity theft a more lucrative and prevalent threat than in previous years.

According to a report by Infosecurity Magazine, the revenue generated by cybercriminals through account takeover has increased by 417% annually. This statistic, cited from Report Fraud, highlights the severe economic impact of credential-based attacks. The sharp rise in profits suggests that threat actors are finding greater success in monetizing stolen login details, likely due to the ease of automation and the high resale value of verified accounts on illicit markets.

The Shift Toward Passkeys

The primary recommendation from police forces is the immediate adoption of passkeys as a replacement for traditional passwords. Passkeys utilize public-key cryptography to authenticate users, eliminating the need for shared secrets that can be guessed, phished, or stolen in data breaches. By removing passwords from the equation, passkeys significantly reduce the attack surface for credential stuffing and phishing campaigns, which are the primary drivers of account takeover incidents.

Traditional password-based authentication remains vulnerable to a variety of attacks, including brute force, dictionary attacks, and social engineering. The 417% increase in cybercrime revenue underscores the effectiveness of these methods when defenders rely on weak or reused passwords. Passkeys, by contrast, are tied to the specific device and user, requiring biometric verification or device PINs to complete the login process. This ensures that even if a threat actor intercepts the authentication signal, they cannot use it to access the account on a different device.

Who Is Affected

This trend affects all individuals and organizations that rely on online accounts for personal or professional use. Consumers with access to banking, email, social media, and e-commerce platforms are at risk, as these accounts often contain sensitive personal information or direct financial access. Businesses are also impacted, as compromised employee accounts can serve as entry points for broader network breaches, leading to data exfiltration, ransomware deployment, or business email compromise schemes.

The surge in cybercrime profits indicates that threat actors are scaling their operations and targeting a wider range of services. Small to medium-sized enterprises that may lack robust identity protection measures are particularly vulnerable, as they may not have the resources to implement advanced monitoring or incident response capabilities. The widespread nature of account takeover attacks means that no sector is immune, necessitating a broad-based shift in authentication practices.

What should you do?

Security professionals and individual users should prioritize the adoption of passwordless authentication methods where available. Organizations should audit their identity management systems to support passkey standards and encourage or mandate their use for critical accounts. Users should check which of their frequently accessed services support passkeys and enable them immediately to reduce exposure to credential theft.

Background: Social engineering

Look for urgency, secrecy, and deviation from standard channels. Verify identity through a separate, known communication path before acting. Isolate suspicious interactions immediately to prevent lateral movement within your network environment.

Read the full guide: Social Engineering Warning Signs and How to Respond

What to do and how to stay safe: account takeover

• Enable passkeys on all supported accounts, starting with email and financial services, to eliminate password-based vulnerabilities.
• Review account activity logs regularly for unauthorized access attempts, especially from unfamiliar devices or locations.
• Ensure that multi-factor authentication is enabled on any accounts that do not yet support passkeys, using hardware keys or authenticator apps rather than SMS.
• Monitor official security advisories from law enforcement and industry groups for updates on emerging account takeover tactics and recommended defenses.

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How much has cybercrime revenue from account takeover increased?

According to Report Fraud, cybercrime revenue stemming from account takeover has increased by 417% annually.

Why are police recommending passkeys?

Police are urging passkey use to combat the surge in cybercrime profits and reduce the risk of account takeover attacks that rely on stolen passwords.

What is the source of this data?

The data is reported by Infosecurity Magazine, citing findings from Report Fraud regarding the annual increase in cybercrime revenue.