Phishing-resistant sign-in: passkeys and security keys
OTPs, SMS codes and push approvals can be phished or worn down. Passkeys and security keys work only on the real website. Here's why, and how to roll them out.
In 60 seconds
Phishing-resistant sign-in: passkeys and security keys
OTPs, SMS codes and push approvals can be phished or worn down. Passkeys and security keys work only on the real website. Here's why, and how to roll them out.
How common MFA gets beaten
| Method | How attackers get around it |
|---|---|
| OTP by SMS | A fake login page asks for the code and uses it on the real site at once. SIM-swap fraud can also redirect texts. |
| OTP from an authenticator app | Same trick: the fake page relays the code to the real site within seconds. |
| Push approval ("Approve sign-in?") | The attacker sends many prompts until a tired user taps Approve ("MFA fatigue"), or calls pretending to be IT. |
| Push with number matching | Better, but a user on a fake page can still be talked into entering the number. |
What makes passkeys and security keys different
- You can type the code into a fake site
- You can approve a prompt you didn't start
- The secret travels to wherever you send it
- Nothing to type; the browser checks the site address
- Sign-in only works on the real site
- The private key stays on your device or security key
Types to know
- Synced passkeys: stored in a password manager or phone account and available on your other devices. Convenient and easier to recover.
- Device-bound passkeys: stay on one device or one hardware security key. Stronger control, but you must plan for loss.
- Hardware security keys: small USB or NFC devices. Good for admins, finance approvers and other high-risk roles.
Rolling it out
- 1
Start with high-risk accounts
Admins, finance approvers, HR, executives and anyone who can change others' access. - 2
Check support
Confirm that your email, single sign-on and key business apps support passkeys or security keys. - 3
Register two
Each person registers at least two passkeys or keys, so losing one doesn't lock them out. - 4
Plan recovery carefully
Recovery is the new weak spot. Require strong identity checks (in person, or a verified video call plus manager approval) before resetting. - 5
Remove weaker options
Once people are set up, turn off SMS or push fallback for those accounts where you can, or attackers will simply choose the weaker path. - 6
Support and explain
Short guides in local languages, a helpdesk ready for questions, and a clear message on why this helps.
Watch and read more
Lab
A passkey rollout plan for a small organisation, including recovery and fallback decisions.
The problem
Plan a rollout of phishing-resistant sign-in for your organisation or a made-up 50-person company. This is a planning exercise on paper. Don't change any real settings unless you are the authorised admin.
- Who first: list the roles in phase 1 and why.
- What: which systems (email, single sign-on, finance, HR, admin consoles), and whether each supports passkeys or security keys. Mark "don't know" honestly where you're unsure.
- Which type: synced passkeys, device-bound passkeys or hardware keys for each group, with one reason.
- Recovery: write the exact steps the helpdesk follows when someone loses their key. Make sure a cloned voice alone can't pass.
- Fallback: which weaker methods you will turn off, and when.
- Communication: a 5-line message to staff explaining the change in simple words.
You are done when
Hard questions
Try to answer before you reveal. If you can answer these, you understood the lesson.
Q1Passkeys stop fake login pages. Name two ways attackers might still try to get into a passkey-protected account, and a defence for each.Reveal
1) Attack the recovery process, for example by calling the helpdesk in a cloned voice to get a reset. Defence: strict identity checks, manager approval through a separate channel, and alerts to the user when a reset happens. 2) Steal an already signed-in session from an infected device. Defence: keep devices updated with EDR, use shorter session times for sensitive apps, and re-check identity for high-risk actions.
Q2Synced passkeys are easier; device-bound keys give more control. How would you choose for a finance approver?Reveal
A finance approver is a high-value target, so many organisations choose a hardware security key (device-bound) plus a registered backup key, kept separately. The trade-off is more effort if one is lost, so clear recovery steps matter. For most staff, synced passkeys give strong protection with easier recovery.
Questions people ask
Are OTPs useless now?
No. Any MFA is far better than a password alone, and OTPs block many attacks. They are just not phishing-resistant. Move the highest-risk accounts to passkeys or security keys first.
What happens if I lose my phone or security key?
If you registered a second passkey or key, use it and then remove the lost one. If not, you'll go through your organisation's recovery process, which should include careful identity checks. That's why registering two is so important.
Do passkeys work with Indian languages and older phones?
Passkeys don't depend on language. Support depends on the operating system, browser and app. Many recent phones and computers support them; older ones may not. Check your devices during planning.
Is a passkey the same as a password saved in the browser?
No. A saved password is still a secret you could type into a fake site. A passkey is a key pair tied to the real site; the private part never leaves your device or key, and it won't work on a lookalike site.
Lesson test
5 questions. Get 3 right (60%) to pass and complete this lesson.