Passkeys Are Great. Here's the One Thing They Don't Protect You From.

A plain-language guide to what a passkey actually is, why it beats a password, and the one habit you still need even after you switch

The moment that sold me on passkeys

You've probably had this moment already, even if nobody explained what was actually happening: you open your banking app, it asks for your fingerprint or your face, and you're in. No password. No "enter the code we texted you." No pausing to remember which of your seventeen password variants you used on this particular site.

That's a passkey. And once you know what's happening under the hood, it's worth understanding because it changes what you should actually be worried about online, and it's not what most people think

What a passkey actually is

Strip away the marketing and a passkey is two mathematically linked keys: a public one and a private one. The private key is generated on your phone or laptop, and it never leaves that device. Not to the website. Not to Apple or Google or Microsoft. It just sits there.

When you log in, the website sends a little challenge, basically "prove you're really you."

Your device signs that challenge with the private key and sends back the signature.

The website checks it against the public key it already has on file, and if it matches, you're in.

Here's the detail that matters most: your device also checks that it's talking to the real website before it agrees to sign anything. Not "a website that looks right." The actual, verified domain. That single check is doing more security work than almost anything else in this story.

Why that makes passwords look bad in comparison

A password is a secret you have to remember and type, which means it's also a secret you can be tricked into typing somewhere you shouldn't. Fake login pages exist specifically to catch people typing passwords into the wrong box. And because most people reuse passwords across sites, a leak at one company you barely think about can quietly unlock your accounts everywhere else.

That second problem reused passwords getting leaked and then tried everywhere is called credential stuffing, and it's been one of the most common ways accounts get broken into for over a decade. Automated tools just try millions of leaked username/password pairs against login pages until something works.

A passkey kills that attack outright. There's no password to leak, no password to reuse, nothing to type into a fake page. The industry has been telling people to switch for a couple of years now, and the numbers say it's actually working: an estimated 5 billion passkeys are in active use worldwide as of mid-2026, and roughly three out of four people have turned one on for at least one account. If you've got the option on your email, your bank, or your social accounts, turning it on is genuinely one of the highest-value five minutes you can spend on your own security.

The part that doesn't get explained

Here's where it gets more interesting, and where I want to be direct instead of hedging: a passkey protects the moment you log in. It does not protect everything that happens after.

When you log into a website with a passkey, a password, whatever, the site doesn't ask you to prove who you are on every single click. That would be miserable. Instead, after that one successful login, it hands your browser a small piece of data (a cookie, essentially a temporary pass) that says "this browser already proved it's allowed in." Your browser shows that pass on every request from then on, and the site just trusts it.

That temporary pass is what attackers have shifted their attention to. There's now an entire criminal market, cheap, subscription-based, no real technical skill required, built around a trick called adversary-in-the-middle phishing.

Here's how it actually works, because seeing the mechanics makes it much easier to spot:

You get a link in an email, a text, a Teams or Slack message. It leads to a page that looks completely real, because it is real, in a sense: the attacker's server sits invisibly between you and the genuine website, quietly forwarding everything back and forth. You log in exactly like you normally would. If the site asks for a passkey, you provide a passkey. If it asks for a text code, you provide the code. From your side, and from the real website's side, everything looks completely normal, because it is a real, legitimate login that just happened.

The catch: the attacker's server was sitting in the middle the whole time, and it just watched that temporary "already logged in" pass go by. It copies it. And now the attacker can walk into your account without ever knowing your password, without ever seeing your passkey, without triggering anything that looked wrong because from the website's point of view, nothing did.

One well-documented example of this, called Tycoon2FA, ran phishing campaigns reaching hundreds of thousands of organizations a month before Microsoft and European law enforcement disrupted its infrastructure in early 2026. It came back within months, and copycats using the same trick Evilginx, EvilProxy, Sneaky2FA never really went away. This isn't a rare, exotic attack anymore. It's a commodity one.

So did switching to a passkey even help?

Yes, genuinely, unambiguously yes, just not against this specific trick. A passkey still closes the door on the older, dumber attacks: leaked-password reuse, fake login pages that try to capture your password directly, MFA-fatigue attacks where you get spammed with approval requests until you tap "yes" by accident. Those are still, by far, the most common ways ordinary people lose their accounts. Passkeys are a real, large upgrade against all of them.

What a passkey can't do is stop someone from stealing the "already logged in" pass after a real login has legitimately happened. That's a different problem, and it needs a different habit, not a different login method.

What actually helps against this

A few things, roughly in order of how much they matter for a regular person:

• Be suspicious of the link, not just the login page. The fake page in this attack looks perfect, because it's mirroring the real one live. The tell is almost always earlier an unexpected urgent email, a link in a text from a "delivery service" you didn't order from, a Teams message from someone you don't work with. If a login prompt shows up because you clicked something you weren't expecting, stop and check the actual web address bar before typing anything.

• Check your active sessions occasionally. Most major services (Google, Microsoft, Apple, your bank) have a page listing every device currently logged into your account, and a button to sign all of them out. If you ever suspect something's off, that button is worth more than changing your password.

• Turn on login notifications if your accounts offer them, and actually read them. "New sign-in from a device you don't recognize" is exactly the kind of alert this attack triggers, because a new device really is using your session.

• Still use the passkey. None of this is a reason to skip it. It closes off the far more common attacks, and it costs you nothing.
  

The takeaway

A passkey is a real upgrade, not a security theater feature it removes an entire category of attack that has ruined more accounts than almost anything else. But it protects the front door, not the whole house. The habit worth building isn't a better login method on top of the one you just got; it's a healthy suspicion of unexpected links, and the two-minute habit of checking what's actually logged into your accounts once in a while.

Turn on the passkey. Just don't let it convince you that everything after the login screen takes care of itself.

Sources

• FIDO Alliance, The State of Passkeys 2026: Global Consumer and Workforce Report (May 2026) — passkey adoption and usage figures

• Microsoft Security Blog, Inside Tycoon2FA: How a leading AiTM phishing kit operated at scale (2026)

• Cisco Talos, State-of-the-art phishing: MFA bypass

• Verizon, 2026 Data Breach Investigations Report — background on credential-based attack trends (via Help Net Security and Descope coverage) .