Why passkeys belong in your phishing defences

TL;DR

Passkeys offer protection against fake login pages that passwords and manually entered one-time codes cannot provide. The UK's National Cyber Security Centre now recommends passkeys wherever a service supports them. For businesses, the work includes checking fallback sign-in and account recovery, as well as adding a passkey button.

Key details

On 23 April 2026, the UK NCSC recommended passkeys as the preferred consumer login option where available. It continues to recommend password managers and two-step verification for services that do not support them.

The technical distinction matters. As Mozilla's passkey documentation explains, a passkey uses a public and private key pair scoped to a service. The browser checks which site is requesting authentication, and the server can verify the origin. A lookalike website cannot simply use the passkey registered for the real service.

The FIDO Alliance's deployment guidance also distinguishes between offering passkeys and enforcing phishing-resistant authentication. Passwords and manually entered codes remain phishable alternatives when an account still accepts them.

What businesses can do

We recommend treating this as a change to the whole sign-in process:

• Start with a pilot. Test the devices and browsers your users actually have, including what happens when someone loses a device.
• Review every fallback. An attacker may try a password reset or support-assisted recovery instead of the passkey login.
• Help users register suitable backup authenticators before they need to recover an account.
• Explain which requests your team will never make, including asking customers to read out a sign-in code.

FIDO's guidance describes a staged rollout that accounts for login and recovery together. Mozilla also notes that passkeys do not eliminate threats to devices or weaknesses elsewhere in account recovery.

Our take

For customer messaging, we recommend keeping notifications separate from proof of identity. A text can tell someone that a task needs attention. Let them open your app or website independently and authenticate there.

That gives the message a useful job while reducing how much trust a customer must place in an unexpected link.