As reported by The Hacker News, Meta has expanded WhatsApp's authentication model to support multiple passkeys tied to a single account across iOS and Android, alongside a strengthened two-step verification password and richer caller context for unknown numbers. The headline number — over a billion people already using a passkey to log into WhatsApp — is the part that should make security teams pay attention, not the feature list itself.

Key Takeaway: The headline number — over a billion people already using a passkey to log into WhatsApp — is the part that should make security teams pay attention, not the feature list itself.

Multi-passkey per account is the genuinely important detail. Single-passkey implementations have been the Achilles' heel of consumer passkey rollouts: lose the device, lose access; switch platforms, start over. By allowing a user to register independent passkeys from each of their devices, Meta is solving the recovery and portability problem that has slowed enterprise passkey adoption for years. It also quietly normalizes the expectation that an identity can carry multiple device-bound credentials without a password fallback — a meaningful shift in consumer mental models.

Why This Matters Beyond WhatsApp

WhatsApp is not just a consumer chat app. It is a de facto communication channel for financial services, logistics, healthcare coordination, political organizing, and customer support in much of the world. Account takeover on WhatsApp translates directly to social engineering of contacts, business email compromise-style fraud, and interception of one-time codes sent over SMS-alternative channels. Every account moved to phishing-resistant auth reduces a real attack surface that defenders have struggled to address because the control sits with the end user, not the enterprise.

The billion-user passkey milestone matters because it proves the deployment economics work at planet scale — not because any single feature is novel.

What Defenders Should Actually Do

What Defenders Should Actually Do
Treat WhatsApp as an identity surface in your threat model. If your organization uses WhatsApp Business, customer support lines, or employees who handle sensitive coordination over the app, push passkey enrollment as part of onboarding. The two-step verification upgrade from a 6-digit PIN to a full alphanumeric password is overdue — enforce it.
Update phishing training. Traditional SMS-OTP interception training is still relevant, but staff who handle communications over WhatsApp should understand that passkeys eliminate the most common takeover vector: credential phishing via bogus login prompts. Reinforce that the new caller context feature exists and should be used before answering unknown numbers.
Watch for the recovery gap. Multi-passkey helps, but account recovery flows remain the soft target for passkey-protected accounts. Meta has not publicly detailed how WhatsApp handles recovery when all device passkeys are lost. Until that is clarified, treat WhatsApp accounts as still vulnerable to SIM-swap-adjacent social engineering against support staff.
Pressure your own vendors. If Meta can ship multi-passkey to a billion users, your SaaS providers and IdPs have no excuse for password-only or single-passkey-only auth. Use this rollout as leverage in vendor security reviews.

Broader Implications

The trajectory is clear: passwords are being demoted to a legacy fallback on the world's largest platforms. Meta added passkeys to Facebook in mid-2025, WhatsApp followed, and the multi-device refinement suggests the company is now optimizing for retention rather than just initial rollout. Expect Apple, Google, and Microsoft to accelerate similar multi-credential-per-account patterns, and expect attackers to pivot harder toward recovery-flow abuse, device theft with passcode coercion, and malicious passkey registration via compromised sessions.

For CISOs, the lesson is not to copy WhatsApp's feature set but to recognize that consumer-grade phishing resistance is now table stakes. If your workforce and customers are getting better auth on a chat app than on your line-of-business systems, that is a gap that will be exploited.

Shield53 Recommendations

  • Enroll every WhatsApp Business and staff account in passkeys immediately; disable SMS-only login where the option exists.
  • Migrate two-step verification from 6-digit PIN to the new alphanumeric password and store it in an enterprise password manager, not personal notes.
  • Brief communications and support teams on the new caller-context feature and build a 'do not act on urgent WhatsApp requests' policy.
  • Audit your own identity stack: if it does not support multiple passkeys per user with managed recovery, raise it as a priority gap this quarter.
  • Monitor Meta's recovery documentation and update internal guidance when the full recovery model is disclosed.