US Stock Investment App 'Woodstock' Adopts Passkey: Authentication Mandatory for Login and Key Transactions from June 26

Woodstock Inc. (Headquarters: Minato-ku, Tokyo; CEO: Brian Jaehoon Yoon), operator of the commission-free US stock investment app 'Woodstock', announced the adoption of the new security standard 'Passkey'. Accordingly, starting June 26, 2026 (Friday), passkey authentication will be mandatory for app login and key transactions like withdrawals, further strengthening the security system to protect customer assets.

Next-Generation Authentication Standard to Protect Assets from Unauthorized Access

Woodstock has always prioritized both the security to protect customer assets and the convenience to make investment accessible. By adopting passwordless login, the company has eliminated the hassle of forgotten passwords while reducing risks such as credential stuffing attacks and phishing fraud.

Recently, sophisticated phishing attacks targeting financial institutions and unauthorized access via credential stuffing have become social issues. To better protect customers' valuable assets, the company has introduced the latest authentication standard, 'Passkey'.

Benefits of Adopting Passkey

- Fundamentally prevent phishing: Passkey uses unique digital keys tied to specific websites or apps. Since authentication does not work on fake sites, it prevents the risk of unauthorized account access caused by inadvertently entering information. - Secure authentication via device: Identity verification uses smartphone fingerprint authentication, facial recognition, device passcodes, or pattern locks. These data are not sent or stored on the server side and are processed safely only on the device in hand.

Passkey Authentication Mandatory from June 26 (Friday)

To provide a safe service to all users, Woodstock is mandating passkey authentication for the following operations:

- Target operations: App login, withdrawals, and order placement - Mandatory start date: June 26, 2026 (Friday)

* From June 26, 2026, customers who have not registered passkeys may face restrictions on logging in or executing important transactions. For devices that do not support passkeys, two-factor authentication registration will be required.