Passkeys Explained: Why They Resist Phishing Better Than Codes

Multi-factor authentication stops many account takeovers, but not every type of MFA is equally strong. CISA's fact sheet on phishing-resistant MFA lists the ways attackers get around weaker methods: phishing pages that collect one-time codes, "push bombing" users with approval prompts until they tap Accept, exploiting SS7 telecom weaknesses to intercept SMS codes, and SIM swaps. Passkeys are designed to close most of those gaps.

What a passkey is

The FIDO Alliance defines a passkey as an authentication credential based on FIDO standards. It can be stored on your phone or computer, or on a hardware security key, and you use it to sign in to apps and websites the same way you unlock your device, with a fingerprint, face scan or PIN.

Why it resists phishing

CISA states that "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication," and calls phishing-resistant MFA the "gold standard." The difference comes down to what you hand over:

• With a code, you type a secret into whatever page is in front of you. If that page is fake, the attacker can pass the code to the real site straight away.
• With a passkey, your device does the authentication through the WebAuthn standard instead of you typing a reusable secret, so there is nothing to type into a fake page.

A recent example shows why this matters. Cisco Talos's October 2026 report on UAT-11985 describes a phishing kit that relays Google sign-ins in real time and shows victims the same MFA screen Google requests, which Talos says effectively bypasses MFA.

How to start

1. Begin with your most important accounts: email (it can reset everything else), your password manager, banking and cloud storage.
2. Add a passkey from each account's security settings, and keep at least one recovery method you can get to if you lose your phone.
3. Where an account offers it, register a second passkey or a hardware security key as a backup.
4. Keep using a password manager for sites that don't support passkeys yet.

Limits

Passkeys protect the sign-in step. They don't protect an account if malware is already on your device, and recovery flows (email links, support calls) can still be a weak point. CISA also notes that any MFA is better than none, so if a service only offers codes, use codes rather than nothing.

More: Cybersecurity coverage.