نشر خدمة "بدون كلمة مرور" في أحد أكبر البنوك في العالم باستخدام RSA ID Plus

One of the world’s largest banks has chosen RSA ID Plus to build the foundation for a fully passwordless future—eliminating password-based vulnerabilities across internal employees, contractors, and high-value customers. The bank’s approach, the authenticators they chose, and what the deployment required are documented in the full case study.

Read on for the key questions that frame any large-scale passwordless banking initiative, an implementation framework based on how deployments like this actually progress, or download the complete case study.

FIDO2 is the open standard that makes phishing-resistant, passwordless login possible. When a user registers a FIDO2 device, a unique cryptographic key pair is generated: the private key never leaves the device, and the public key is registered with the application. At login, the device signs a challenge that is cryptographically bound to the legitimate website—so even if a user is deceived into interacting with a fraudulent page, the authentication response cannot be used there.

Device-bound passkeys extend this further: the credential is tied to a single physical device and cannot be exported or cloned. For banking environments where insider threats and device sharing are real concerns, this level of binding provides the highest available assurance. RSA’s long-standing involvement in the FIDO Alliance puts it at the center of how these standards are developed and implemented.

A bank’s user population is not uniform. Internal employees, contractors, high-net-worth customers, and mobile workers all have different device access, security requirements, and tolerance for friction. A passwordless deployment that works for traders on fixed workstations but fails for contractors on shared devices, or for customers on mobile, isn’t a complete solution.

RSA ID Plus addresses this by supporting the full spectrum of passwordless and MFA المقاوم للتصيد الاحتيالي methods—hardware security keys, device-bound mobile passkeys, and hardware tokens—across cloud, hybrid, and on-premises environments. Hybrid failover ensures that authentication remains available even when connectivity is disrupted, a critical requirement for financial services operations.

Large-scale passwordless deployments don’t happen overnight. For a bank with tens of thousands of users across multiple systems and geographies, the move from password-based access to fully phishing-resistant authentication is a multi-phase program. Here is how deployments of this scale typically progress.

Phase 1. Assessment and planning

Before deploying any technology, the bank’s identity and security teams map every user population, system, and authentication use case. This means identifying which users need hardware keys versus mobile passkeys, which legacy systems require bridging solutions, and what the rollback plan is if a method fails in a particular environment. Planning at this phase prevents the gaps that surface mid-deployment and force costly rework.

Phase 2. Pilot deployment

A defined subset of users—typically a single business unit or a cross-functional pilot group—deploys the new authenticators in a controlled environment. The goal is not just technical validation but workflow validation: does the authentication experience work for how these users actually operate? Issues with provisioning, helpdesk processes, and user communication are far cheaper to resolve in a pilot than at scale.

Phase 3. Phased full-scale rollout

Rollout expands department by department or role by role, prioritizing the highest-risk user populations first—privileged access accounts, trading floor staff, compliance systems users. Each wave incorporates lessons from the previous one. For the bank in the case study, RSA Professional Services provided on-site support throughout this phase, ensuring the deployment stayed on track at every step.