Bank BNP Paribas has introduced passkeys for signing in to GOonline Biznes, its online banking service for SME and corporate clients, using technology provided by Secfense, a FIDO Alliance member. The bank began making the new sign-in option available in stages on 5 October 2026. The implementation brings phishing-resistant authentication to an established business banking platform. Working together, Bank BNP Paribas and Secfense introduced passkey sign-in for GOonline Biznes clients.

The challenge

For business banking clients, signing in needs to be straightforward and secure. Phishing sites can closely imitate a bank’s website, making passwords vulnerable to theft even when users believe they are accessing the right service.

Bank BNP Paribas wanted to offer clients a simpler, phishing-resistant way to sign in. The implementation also needed to fit the operating requirements of a live banking platform, accommodate different client devices and preserve established transaction authorization methods.

This required an approach that connected modern authentication standards with the bank’s existing application environment.

How it works

Clients store a passkey on a trusted device and confirm their identity with a fingerprint, face recognition or the device PIN. Supported options:

• Windows 10 or 11, with Windows Hello;

• Android 9 or later, with Google Password Manager;

• iPhone and iPad with iOS/iPadOS 16 or later, with iCloud Keychain;

• hardware security keys, such as YubiKey.

The passkey is bound to the bank’s domain, bnpparibas.pl. On a lookalike site it does not appear, so it cannot be used.

Passkeys are used for sign-in only. Clients continue to authorize transactions with the method their company already uses, and signing in with a login and password remains available.

The implementation

Bank BNP Paribas implemented passkey sign-in for GOonline Biznes with support from Secfense. The bank is making the new sign-in available in stages.

Part of a wider security approach

Passkeys are one element of the bank’s approach to client security. It also includes behavioral protection, which analyzes how clients use online banking to detect unusual activity, as well as cybersecurity webinars for entrepreneurs and online training.

Considerations for other banks

The Bank BNP Paribas and Secfense implementation highlights several considerations for institutions planning a similar transition:

• Define the initial scope. Introducing passkeys for sign-in while retaining existing transaction authorization keeps the first phase focused.

• Assess the operating requirements of existing applications. An implementation approach should account for the needs of a live banking platform.

• Accommodate different working environments. Support for platform authenticators and hardware security keys gives business clients flexibility.

• Introduce the change gradually. A staged rollout creates opportunities to assess registration, sign-in and support needs as availability expands.

• Plan the full access lifecycle. Client guidance, additional passkey registration and account recovery should be considered alongside the sign-in experience.

Results

Passkey sign-in has been rolling out to GOonline Biznes clients since 5 October 2026. The initial milestone is the availability of a new phishing-resistant sign-in option within the existing business banking service.

The collaboration demonstrates how a bank and an authentication technology provider can bring passkeys to an established platform while preserving familiar transaction processes and giving clients a choice in how they adopt the new capability.

About Bank BNP Paribas

Bank BNP Paribas is a universal bank serving individual customers, microbusinesses, small and medium-sized enterprises, and large corporations. It is part of the international BNP Paribas Group and has been listed on the Warsaw Stock Exchange since 2011. The bank offers a broad range of financial services, including corporate banking, financing solutions, and digital banking services.

About Secfense

Secfense is a Polish cybersecurity company and a member of the FIDO Alliance. It helps organizations protect access to applications and infrastructure while keeping their existing systems. Secfense Ghost keeps protected internet-facing services out of reach of unverified sources, before connection or login. Secfense enables organizations to add passkeys and phishing-resistant MFA to existing applications without modifying their source code.