Securing Digital Wallets: How FIDO is Anchoring AI Commerce

CARLSBAD, Calif. – October 20, 2026 — For the past decade, the technology industry has waged a relentless war against the password. Through the widespread adoption of passkeys, the FIDO Alliance successfully shifted the paradigm of device-level authentication. But as the digital landscape evolves, simply logging in is no longer the primary battlefield. The new frontier is the digital wallet, and increasingly, the autonomous AI agents that act on our behalf.

At the Authenticate 2026 conference today, the FIDO Alliance signaled a massive strategic expansion. The consortium announced it will publicly release core working documents from its digital wallet certification initiative in the coming weeks and formally launched an External Advisory Forum. These moves are designed to establish unified, global baselines for digital credential managers and verifier identification, effectively building the infrastructure required for a post-password, AI-driven world.

"The vast potential of digital credentials will only be realized if people, organizations and governments can trust them wherever they’re used," said Andrew Shikiar, Executive Director and CEO of the FIDO Alliance. "That takes open standards, certification the market can rely on, and alignment from every side of the ecosystem. Today’s announcements put all three in motion. We’re proud that the industry has come together through the FIDO Alliance to make this vision a reality."

The Missing Half of Digital Wallets: Solving Verifier Impersonation

While mobile wallets have made significant strides in proving a user's identity, the ecosystem has long suffered from a glaring asymmetry: websites and services requesting credentials have operated with minimal accountability. Digital wallets excel at authenticating the human holding the device, but they have historically lacked scalable mechanisms to validate the identity of the relying party—the entity asking for the data.

This one-way trust model leaves users vulnerable to sophisticated presentation-layer phishing, where malicious actors spoof legitimate services to harvest verifiable credentials.

To close this gap, the consortium introduced the Verifier Identification framework. The new protocol describes exactly how a credential manager receives structured, cryptographically verified information about the website or service asking for a person's data. By leveraging existing protocols from bodies like the OpenID Foundation, the framework ensures that users are presented with clear, accurate trust signals before they approve any credential sharing.

Industry security architects note that this two-way trust dilemma has been the missing half of the digital wallet equation. By establishing cryptographic proof of a relying party's identity, the new framework prevents bad actors from impersonating legitimate services, effectively neutralizing credential phishing at the point of presentation. This is operationalized alongside the newly announced Credential Manager Reference Architecture (CMRA), which defines the functional, security, and interoperability requirements that digital wallets must meet to achieve global certification.

Identity for AI: Anchoring the Agentic Commerce Market

Perhaps the most forward-looking aspect of the announcement is its direct application to the booming artificial intelligence sector. As autonomous software begins executing purchases, booking travel, and accessing accounts, the line between automated script and human authorization is blurring. Analysts project the agentic commerce market could reach $5 trillion globally by 2030, but that growth relies entirely on the ability to trust the agents executing the transactions.

The consortium is positioning verifiable human identity credentials as the cryptographic tether required to control and audit agent behavior. The internet's trust infrastructure was built on the assumption of human interaction. AI agents fundamentally alter this architecture, creating a missing trust layer that necessitates verifiable, policy-bound execution.

This initiative has already drawn massive industry weight. Earlier this year, Google donated its Agent Payments Protocol to the consortium to foster platform-agnostic, community-led innovation for "Human Not Present" payments. Mastercard followed suit by contributing its Verifiable Intent framework, which creates a tamper-proof log of user-authorized agent actions. Furthermore, leading AI developers like OpenAI have recently taken seats on the consortium's Board of Directors to help shape these exact authentication guardrails.

These corporate maneuvers align perfectly with public sector priorities, such as the AI Agent Standards Initiative launched by the National Institute of Standards and Technology in February 2026. Government technologists have strongly advised against using shared human credentials or static API keys for autonomous software, recommending the exact type of short-lived, tightly scoped, and cryptographically accountable credentials the new architecture provides.

Public Sector Meets Private Tech: Shaping Global eID Wallets

The implications of these standards extend far beyond corporate AI and consumer payments; they are deeply entwined with the global rollout of national digital identities. With the European Union's eIDAS 2.0 regulation mandating the deployment of the EU Digital Identity Wallet, governments worldwide are grappling with the technical realities of secure, interoperable credential management.

To bridge the gap between private sector innovation and public sector regulation, the consortium launched the External Advisory Forum. This non-binding channel provides governments, issuers, regulators, and industry associations with direct visibility into the digital credentials work and certification programs.

Rather than competing with existing standards like W3C Verifiable Credentials or ISO mobile driving licenses, the new reference architecture is designed to harmonize them. It acts as a foundational layer that ensures consistent, secure implementations across varied protocols. By leveraging these unified baselines, government wallets can achieve economies of standardization, accelerating adoption among service providers that require high levels of security assurance.

Major platform providers are already signaling their alignment. While proprietary wallet roadmaps remain closely guarded, the heavy executive presence of technology giants on the consortium's board indicates that the underlying operating systems powering today's mobile devices are preparing to support these new baselines. The success of passkeys was driven by seamless integration across diverse cloud ecosystems, and the industry is clearly attempting to replicate that playbook for digital credentials.

As the digital and physical worlds continue to merge, the ability to cryptographically prove who we are—and securely delegate tasks to the software acting on our behalf—will define the next era of the internet. By moving to certify the wallets that hold our data and the agents that spend our money, the industry is laying the groundwork for a digital economy rooted in verifiable trust.