Passkey

What it means

A passkey is a passwordless sign-in method built on the FIDO standard. The user verifies themselves the same way they unlock their phone or computer, with a fingerprint, face or PIN, and the device then proves their identity to the service with a cryptographic key that never leaves the device.

The main advantage is resistance to phishing. The key is bound to a specific domain, so on a fake page merely pretending to be a bank or email provider the sign-in simply does not work. An attacker has nothing to lure out, because the user never types a secret.

A passkey replaces the password and at the same time does the job that two-factor authentication used to do: it combines something the user has, the device, with something they are or know, biometrics or a PIN. It can be synced across devices through the vendor’s account or a password manager.

How it works in practice

We advise companies to switch on passkeys first where a leaked login would hurt most: company email, online banking, the accounting system and access to government portals. A compromised mailbox is precisely the usual entry point for BEC fraud with fake payment instructions.

When rolling them out, plan for account recovery. Every employee should have at least two ways to sign in, such as a passkey on both phone and laptop or a hardware key, so that losing one device does not lock the account.

If staff work on their own devices under BYOD, the company should know where company passkeys are stored and how they are revoked when someone leaves. The access administrator should remove them on the same day the employment ends.

What to watch out for

A passkey protects the sign-in, not the whole device. If a phone is unlocked in a stranger’s hands or infected with malware, an attacker can act on the user’s behalf. A screen lock and an up-to-date system therefore remain essential.

Leaving the old password as a fallback is another risk. As long as the password still works for the account, it can be phished and misused. After introducing passkeys, it makes sense to change the password to a long random one kept only in the manager, or to disable it entirely if the service allows.