Valve still has not shipped native passkey sign-in for Steam as of October 22, 2026, even as a cluster of alleged PlayStation Network account-takeover reports piles up and the FIDO Alliance announces that more than 7 billion passkeys are now in active use worldwide. The gap matters because the reported PSN incidents did not involve anyone cracking a passkey or defeating two-factor authentication through brute force. According to multiple gaming-news outlets, attackers instead talked their way past Sony’s own support staff, using a PSN ID, a linked email address, or an old purchase record to convince an agent that they were the account owner. That distinction, cryptography versus customer service, is becoming the defining fault line in gaming-account security heading into the holiday shopping season.
The timing has put two separate stories on a collision course. On one side, the FIDO Alliance used its Authenticate 2026 conference in mid-October to tout passwordless authentication crossing 7 billion credentials globally, alongside new certifications from hardware vendors and enterprise software makers. On the other, several outlets covering PlayStation report that at least eight account-takeover cases surfaced between September 29 and October 6, 2026, with additional complaints continuing into mid-October, all pointing to the same support-desk weakness rather than a technical break of Sony’s authentication systems. Steam, meanwhile, remains the odd platform out: still leaning on Steam Guard’s mobile-authenticator codes and email recovery rather than FIDO2-based passkeys, according to an October 20, 2026 report from Windows Forum that also says Xbox, Nintendo, and PlayStation already confirm passkey support.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Steam’s Passkey Gap Resurfaces Amid a PSN Takeover Wave
Steam’s account-protection stack has not meaningfully changed in the past three months. No official Valve announcement documenting a passkey rollout or a major Steam account-security redesign has surfaced through October 22, 2026. The Windows Forum report dated October 20, 2026, lays out the comparison bluntly: Steam continues to promote the free Steam Guard Mobile Authenticator and relies on account-recovery checks built around email, phone numbers, purchase history, and trade or market restrictions, while rival platforms have already layered in FIDO2-based sign-in.
That gap is notable given how much money sits behind a typical Steam library. A compromised account can mean losing access to years of purchases, trading-card inventories, and in-game items with real resale value on the Steam Community Market. Steam Guard’s mobile authenticator, QR-code login approval, and rotating codes are still a meaningful step up from a bare password, but none of it is phishing-resistant in the way a FIDO2 passkey is designed to be. A phished Steam Guard code can still be relayed to an attacker in real time; a passkey, by design, cannot be typed into a fake login page because it never leaves the device as a reusable secret.
One Steam Community discussion dated October 4, 2026, shows players themselves asking Valve for physical security-key support, a feature request that has circulated in various forms for years without an official response. The lack of movement is less about neglect than architecture: Steam’s authentication design predates the current wave of FIDO2 adoption, and retrofitting passkeys into a storefront with hundreds of millions of accounts, regional pricing rules, and a sprawling third-party developer ecosystem is a bigger lift than adding passkeys to a single first-party hardware platform.
Steam Guard Remains Valve’s Only Line of Defense
Steam Guard today means one of three things in practice: a code emailed to the account’s registered address, a rotating code generated inside the Steam Mobile app’s authenticator, or an approval tap sent to that same app during a new-device login. All three routes ultimately depend on either an email inbox or a phone staying secure, which is exactly the chain that credential-stuffing and SIM-swap attacks target. There is no confirmed official price tier or paid plan tied to Steam Guard; it is a free feature bundled with every Steam account, and no current result identifies a named Valve executive or team responsible for the product.
Valve’s own help documentation, reviewed as part of this reporting, continues to describe only password login, Steam Guard codes, and QR-based mobile approval. There is no FIDO passkey option documented anywhere in that flow as of October 20, 2026. That matters because Steam Guard, however useful, is still fundamentally a shared-secret system: a six-digit code can be phished, intercepted, or socially engineered out of a careless user in a way that a device-bound cryptographic key cannot. Gamers who want the strongest available protection today are generally better served pairing Steam Guard with a hardened email account and unique, high-entropy passwords, since Valve has not given them a native passkey alternative to fall back on.
Inside the Alleged PSN Account-Takeover Reports
The PlayStation side of this story is murkier, and that murkiness is itself part of the story. Multiple outlets, including GamesCreed, PlayStation Lifestyle, PlayStationInfo.de, Japan Reacts, and several European and Asian gaming sites, reported a cluster of at least eight alleged PSN account-takeover cases between September 29 and October 6, 2026. The common thread across the reporting: attackers allegedly supplied an account identifier, a linked email address, or a historical purchase or transaction detail, then leaned on Sony support staff to reset an account email or disable two-factor protection outright.
Sony’s own official channels have not confirmed the scale, the root cause, or any company-wide policy response to these reports as of October 22, 2026. The PlayStation Blog’s October updates covered the monthly PlayStation Plus catalog, a “Planet of the Deals” promotion, and a LISA-themed limited-edition DualSense controller, with no public statement addressing the takeover reports found in the available record. That silence has not stopped the complaints from accumulating; IGN separately covered at least one case in which a PlayStation user got an account restored after a takeover, publishing the story under the headline “This Needs to Change” and noting that other victims may not be as fortunate.
It is important to be precise about what is and is not established here. No official Sony result confirms the exact number of affected accounts, a verified attack methodology, or that passkeys themselves were cryptographically bypassed. What the reporting consistently describes instead is a recovery-process weakness: support representatives, working from limited identity signals, appear to have been persuaded in multiple cases to override account protections that were otherwise functioning correctly.
The Support-Desk Loophole: How Social Engineering Beats 2FA and Passkeys
PlayStation Network has supported passkeys since Sony Interactive Entertainment first rolled them out globally, with the February 2024 launch date cited in the Windows Forum comparison report. Sony’s current support material describes enabling the feature through Account Management, then Security, then “Sign in with Passkey,” on PS5, PS4, computers, and mobile devices, alongside authenticator-app and SMS-based two-step verification as alternatives. On paper, that is a stronger authentication stack than Steam offers today.
The reported PSN cases matter precisely because several alleged victims say they had passkeys or two-step verification enabled, yet still lost their accounts. That is not a passkey failure in the cryptographic sense; it is a failure of the account-recovery process sitting behind the passkey. If a support agent can be talked into disabling a security feature or changing the email on file based on a purchase date or transaction ID, the strength of the authentication method in front of that recovery flow becomes close to irrelevant. FinalBoss.io’s coverage of the pattern frames it exactly that way: these are reports about recovery-process manipulation, not evidence that FIDO2 cryptography itself was broken.
This is not a new category of attack industry-wide. Account-recovery social engineering against customer-support desks has hit other sectors for years, and the FIDO Alliance’s own research consistently frames recovery and account-linking as the hardest unsolved problem in passwordless authentication, harder in some ways than the sign-in moment itself. What is new is seeing the pattern surface at scale against a console ecosystem that had, until this fall, been held up as one of gaming’s passkey success stories.
Xbox, Nintendo and PlayStation Already Support Passkeys
The Windows Forum report is explicit that Xbox and Nintendo, alongside PlayStation, already confirm native passkey sign-in support, leaving Steam as the lone major holdout among large gaming platforms. That puts Valve in an unusual position: the biggest PC games storefront in the world is currently behind three major console ecosystems on a security feature that the FIDO Alliance considers foundational to where consumer authentication is heading. Players who want passkey protection across their broader digital life can already get it through their console accounts, their Google account, or a dedicated password manager; Steam remains the gap in that coverage.
None of this means console passkeys are bulletproof, as the PSN reports make clear. But it does mean the attack surface is shifting. As more platforms close the sign-in vulnerability that passkeys are built to solve, attackers who want account access have a rational incentive to target the layer those platforms have not hardened yet, which right now looks like customer-support recovery flows rather than the login screen itself.
Gaming Platform Authentication Compared
The table below summarizes the current state of authentication across the major gaming platforms, based on the most recent reporting available as of October 22, 2026. Passkey availability refers to native FIDO2/WebAuthn support rather than password-and-code systems like Steam Guard.
| Platform | Native Passkey Support | Primary Account Protection Today | Reported October 2026 Security Issue |
|---|---|---|---|
| Steam (Valve) | Not confirmed as of Oct. 20, 2026 | Steam Guard Mobile Authenticator, email recovery, QR login | No confirmed platform-wide breach; passkey gap flagged by comparison reporting |
| PlayStation Network (Sony) | Confirmed, rolled out Feb. 2024 | Passkeys, authenticator-app and SMS-based 2FA | Alleged support-desk social engineering bypassing 2FA/passkeys, Sept. 29–Oct. 6, 2026 |
| Xbox (Microsoft) | Confirmed | Passkeys, Microsoft Account security | No qualifying security incident confirmed in current reporting |
| Nintendo | Confirmed | Passkeys, Nintendo Account security | No qualifying security incident confirmed in current reporting |
The pattern in that table is the real story: passkey availability and real-world account security are not the same thing. PlayStation has the feature Steam lacks, and it is still the platform generating takeover complaints this fall, because the vulnerable point sits in the recovery process rather than the login form.
FIDO Alliance Crosses 7 Billion Passkeys Worldwide
Against that backdrop, the FIDO Alliance delivered a milestone. The organization reported an estimated 7 billion passkeys in active use worldwide as of mid-October 2026, a figure independently picked up by Biometric Update. That is a sharp jump from the 5 billion passkeys the Alliance had announced back in May 2026 under the headline “A Milestone, Not a Finish Line,” suggesting adoption accelerated meaningfully across the summer and into the fall.
The growth is coming from outside gaming as much as from within it. The FIDO Alliance pointed to UK government services reducing reliance on SMS-based authentication, projecting future savings for taxpayers, in a piece published in September 2026. At its Authenticate 2026 conference, held October 19–20, 2026, the Alliance said its next major focus areas include digital credentials and authentication for agentic commerce, the emerging category of AI agents that make purchases or manage accounts on a user’s behalf. Gaming platforms, by comparison, are a comparatively small and uneven slice of that 7 billion figure: three of the four major platforms compared above have passkeys, but the one with the largest active user base among PC gamers, Steam, still does not.
The FIDO Passkey Rubric and 2026 Passkey Index
In the same mid-October window, the FIDO Alliance introduced what it calls the FIDO Passkey Rubric alongside its 2026 Passkey Index, new tools intended to give companies and researchers a standardized way to score how well a given passkey implementation actually protects users, rather than simply whether passkeys exist as an option. That framing lines up almost exactly with what the PSN reports illustrate: a platform can check the box on “supports passkeys” and still leave a gap at the account-recovery stage that a rubric focused only on sign-in cryptography would miss entirely.
It is a useful idea for an industry that has spent the last three years treating passkey adoption as a binary feature checklist. Whether the Rubric or the Index end up being applied specifically to game platforms is not yet established in current reporting, but the timing, arriving the same month as a public account-takeover controversy at one of the platforms the Alliance itself credits with an early passkey rollout, is hard to ignore.
Enterprise and Government Adoption Outpaces Gaming
Outside of gaming, FIDO2 certification activity has been unusually busy this October, underscoring how far ahead other sectors are moving relative to game storefronts. The table below lists certified product launches and milestones the FIDO Alliance itself announced or confirmed during the first three weeks of October 2026.
| Date (Oct. 2026) | Company / Product | What Shipped |
|---|---|---|
| Oct. 5 | IDEMIA Secure Transactions | Infrastructure combining payment tokenization, passkey-based cardholder authentication, spending limits and consent records for AI-agent payments |
| Oct. 12 | SecuGen Unity 20 | FIDO2-certified fingerprint security key (CTAP 2.1, ASL1); supports up to 10 fingerprints and 255 passkeys; general availability planned for Q4 2026 |
| Oct. 12 | Intercede MyID Authenticate | Passkey authentication solution aimed at government agencies and enterprises |
| Oct. 19 | Zumigo InstaAuth | Achieved full FIDO2 Server Certification (CTAP 2.1), bringing certified passkey sign-in to banks, fintechs and merchants |
Banking, government identity services, and payment infrastructure are moving on passkeys at a pace gaming platforms have not matched. Part of that gap is regulatory: financial services and government agencies face compliance pressure that a video game storefront does not. Part of it is simply inertia; Steam’s account base predates the FIDO2 standard by well over a decade, and migrating that scale of legacy accounts carries engineering and support costs Valve has so far chosen not to absorb.
Why Valve Has Been Slow to Move on Steam Passkeys
Valve rarely explains its product roadmap publicly, and nothing in the current record establishes an official reason for the absence of Steam passkeys. What can be said is that Valve’s security investment over the past year has visibly gone elsewhere: anti-cheat infrastructure, Steam Deck hardware security, and account-recovery tooling for the existing Steam Guard system have all seen more attention than a ground-up authentication overhaul. One nonofficial comparison page has claimed Steam already has a “third-party FIDO2 passkey rollout,” but that claim conflicts with its own acknowledgment elsewhere that Steam has not added native passkey support, and it should be treated as unverified rather than a confirmed feature.
The business case for Valve to move is nonetheless getting stronger. A September 23, 2026 update to Steam’s account-security guidance, according to available reporting, told users to review authorized devices, use the “sign out everywhere” option, and scan for malware before trusting a changed password, and separately warned that genuine Steam Support staff never contact users through Discord or Steam Chat. That is defensive messaging aimed at existing threats like malware-driven credential theft and impersonation scams, not a signal that a passkey rollout is imminent. Until Valve ships one, players chasing the strongest available protection are better served combining Steam Guard with a hardware security key on their email provider, since that is the account an attacker would target first anyway.
Market Impact: Account Security as a Platform Differentiator
Digital game libraries are, for a growing share of players, irreplaceable. Unlike a stolen credit card, a hijacked Steam or PlayStation account can mean losing a decade of purchases with no physical backup to fall back on. That stake only grows if Sony follows through on what GamesIndustry.biz has reported as a survey of developers about ending PlayStation disc support for new console games, with some reporting pointing to a possible cutoff as early as January 2028. If physical media for new releases genuinely winds down on that timeline, an account takeover on a console stops being an inconvenience and starts being closer to a total loss of a library that was never backed up anywhere else.
That dynamic is starting to turn account security into something platforms can compete on rather than a background compliance checkbox. A storefront that can credibly say its support desk cannot be socially engineered into disabling 2FA has a real marketing argument, especially after a fall in which PSN’s support process became a public liability despite the platform’s passkey head start. Expect platform holders to start quietly tightening support-verification procedures, even without a public admission that the current process has a problem, because the reputational cost of repeated “account restored, but it shouldn’t have happened” stories compounds over time.
Predictions: Where Gaming Account Security Goes From Here
Several trends look likely to play out over the next several months, based on the current trajectory of both the FIDO ecosystem and the PSN reporting:
- Support-desk verification tightens industry-wide. Expect PlayStation, and likely other platforms watching the fallout, to quietly add friction to account-recovery calls and chats, even without publicly confirming the reported September–October incidents.
- Steam faces growing pressure to add passkeys, but a 2026 rollout remains unconfirmed. Valve has shown no public timeline, and retrofitting FIDO2 into Steam’s login and recovery flows at its scale is a multi-quarter engineering project at minimum.
- The FIDO Passkey Rubric and 2026 Passkey Index start getting applied to high-profile consumer platforms, potentially including gaming storefronts, as researchers look for a standardized way to score real-world account security rather than just feature checklists.
- Passkey adoption keeps climbing well past the 7 billion mark the FIDO Alliance reported in October 2026, driven mainly by banking, government services, and AI-agent payment infrastructure rather than gaming.
- Expect more individual PSN and Steam account-takeover stories to surface publicly, following the pattern IGN and other outlets set this fall, as affected players increasingly go public when official support channels are slow to resolve their cases.
How Gamers Can Protect Their Accounts Today
Until Steam ships native passkeys and Sony tightens its recovery process, the practical defense for most players comes down to the basics done consistently rather than waiting on a platform fix. Enable the strongest authentication option each platform currently offers, which for PlayStation, Xbox, and Nintendo already means a passkey, and for Steam means the Mobile Authenticator rather than email-only codes. Lock down the email account tied to every gaming login with its own strong, unique credentials, since that inbox is frequently the real target behind an account-recovery attack. Avoid sharing PSN IDs, purchase dates, or transaction details publicly, since the reported PSN cases specifically describe attackers using exactly that kind of information to impersonate account owners to support staff.
Players who suspect they have already been targeted should terminate every active session before trusting a newly changed password, a step Steam’s own September 2026 guidance specifically recommends, since a password change alone does not revoke sessions an attacker already opened. The same logic applies on PlayStation and extends to other gaming accounts tied to payment methods or valuable digital inventories. None of this is a substitute for the platforms themselves closing the recovery-process gap the PSN reports describe, but it meaningfully narrows the window an attacker has to work with.
Broader account-security practices, including the kind of layered monitoring described in coverage of the security infrastructure behind modern gaming platforms, point the same direction: the strongest technical authentication method is only as strong as the weakest human process behind it, and right now, that weakest link sits at the support desk rather than the login screen.
Frequently Asked Questions
Does Steam support passkeys in 2026?
No. As of October 20–22, 2026, available reporting indicates Steam has not launched native FIDO2/WebAuthn passkey sign-in. Valve continues to rely on Steam Guard’s Mobile Authenticator, email-based recovery, and QR-code login approval.
Does PlayStation Network support passkeys?
Yes. Sony Interactive Entertainment rolled out global PlayStation passkey support starting in February 2024, and current PlayStation support material describes enabling it through Account Management, then Security, then “Sign in with Passkey,” on PS5, PS4, computers, and mobile devices.
Were PSN passkeys actually hacked this fall?
No evidence in current reporting shows passkey cryptography was broken. The reported account-takeover cases, at least eight between September 29 and October 6, 2026 according to multiple gaming outlets, describe attackers persuading PlayStation support staff to reset account protections using identifying details like a PSN ID or purchase history, rather than defeating a passkey directly. Sony has not publicly confirmed the scale or cause of these reports.
Do Xbox and Nintendo support passkeys?
Yes. According to an October 20, 2026 comparison report, both Xbox and Nintendo confirm native passkey sign-in support, leaving Steam as the main large gaming platform without one.
How many passkeys are in use worldwide right now?
The FIDO Alliance reported an estimated 7 billion passkeys in active use globally as of mid-October 2026, up from the 5 billion milestone it announced in May 2026.
What is the FIDO Passkey Rubric?
It is a framework the FIDO Alliance introduced in October 2026, alongside its 2026 Passkey Index, intended to give a standardized way to score how well a specific passkey implementation actually protects users in practice, rather than just whether a platform offers passkeys as an option.
What should I do if I think my gaming account was compromised?
Change your password, then explicitly terminate every active session rather than assuming a password change alone removes an attacker’s access. Review authorized devices, scan for malware, and contact the platform’s official support channel directly. Be aware that Steam Support will never contact you first through Discord or Steam Chat, a distinction scammers have exploited in impersonation attempts.
Is Steam planning to add passkeys?
No official Valve announcement confirms a passkey rollout, timeline, or related security redesign as of October 22, 2026. A Steam Community discussion from October 4, 2026, shows users requesting physical security-key support, but this is user discussion rather than a Valve roadmap commitment.
