iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use passkeys or FIDO2 security keys first on email, financial, administrator, and other high-value accounts, and register a second authenticator before you need to recover access. These phishing-resistant methods bind sign-in to the real service, so a look-alike site cannot simply collect and relay the authentication response. If a service does not offer them, enable its strongest available MFA, such as number matching, while treating SMS, email codes, push approvals, and manually entered one-time passwords as weaker fallbacks.
Why do AI-powered credential attacks change account security?
AI can help attackers create phishing campaigns faster and at greater scale, making it more important to protect the sign-in itself rather than rely on spotting every convincing message. Microsoft Threat Intelligence reported AI-enabled phishing click-through rates as high as 54%, compared with roughly 12% for traditional campaigns, in 2026. Those figures are reported campaign rates, not a prediction that any one user will click a phishing message.
AI can also personalize messages, imitate a company’s writing style, translate lures, and automate follow-up conversations. The practical effect is more believable pressure on employees and consumers, often delivered in larger volumes. A suspicious-looking message is no longer the only warning sign, so authentication that remains safe even when someone visits a convincing fake site is especially valuable.
Recommended Free Tools
The risk does not end with a stolen password. Microsoft says a compromised identity can be used to automate discovery, privilege escalation, and lateral movement. In other words, an attacker may use one account as a starting point to find other resources or gain broader access. Stronger authentication on email, administrator accounts, financial services, and other high-impact accounts helps make that first foothold harder to obtain.
Popular on Amazon
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Multifactor authentication (MFA) adds an authentication factor beyond a password. But the label alone does not tell you whether a method can withstand phishing: some codes and approval prompts can still be intercepted, relayed, or tricked out of a user. The practical priority is therefore to use phishing-resistant authentication wherever the service supports it, and to improve weaker fallback methods where it does not.
What makes a passkey or FIDO2 key phishing-resistant?
A passkey uses public-key cryptography. The device or authenticator keeps a private key; the service stores the corresponding public key. At sign-in, the authenticator signs a challenge from the service, and the service verifies that signature using the public key. The private key is not sent to the service for storage or typed into a web form.
The important anti-phishing property is that the passkey is bound to the registered domain. It is not presented to a look-alike phishing domain, so the attacker cannot simply collect the passkey response on a fake site and replay it to the real service. A FIDO2 security key uses the FIDO/WebAuthn approach as a roaming hardware authenticator; a platform passkey is held on a device. CISA describes FIDO/WebAuthn as the only widely available phishing-resistant authentication and says it blocks authentication on a malicious look-alike site.
A hardware key is useful when you need a separate authenticator that is not dependent on a phone’s battery, operating system, or cloud account. It can be carried for daily sign-in and another can be stored securely as a recovery key. The most honest product category to search for is a FIDO2 security key; confirm that the model supports the FIDO2/WebAuthn flows required by your service.
This is different from a secret a user can copy from one screen to another. NIST defines phishing resistance in terms of preventing disclosure of secrets or authenticator outputs to an impostor verifier. A manually entered one-time password is not phishing-resistant because it is not bound to the session: a phisher may collect the code and relay it while it is valid.
Do passkeys count as MFA?
They can. A passkey can provide MFA when access to the device-held credential is unlocked with a PIN or biometric. The authenticator combines possession of the device or credential with a local unlock step; the service still verifies the cryptographic response rather than asking the user to type a transferable code.
Whether a particular service treats a passkey as satisfying its MFA policy depends on that service’s implementation and account settings. Check the service’s security page or policy rather than assuming that every passkey enrollment automatically changes all other authentication requirements. Some services may continue to request a password, recovery factor, or separate administrator approval.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Also popular on Amazon
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Which authentication method should I choose?
Use passkeys or FIDO2 keys first where available, especially on accounts whose compromise could expose other accounts or important data. If you cannot use them on a service, select the strongest MFA option it offers and regard it as a fallback rather than an equivalent substitute.
| Method | Phishing resistance | What to know |
|---|---|---|
| Passkey or FIDO2/WebAuthn security key | Phishing-resistant | Authentication is bound to the registered service domain; a malicious look-alike site cannot obtain a valid sign-in response. It requires an enrolled device or key and a recovery plan. |
| Number-matching MFA | Fallback; not established as phishing-resistant in the cited guidance | A stronger available alternative when the service lacks passkeys, but plan a move to FIDO/WebAuthn when possible. It can still depend on a user approving an unexpected request. |
| SMS code | Phishable | Microsoft identifies SMS methods as increasingly vulnerable to interception and spoofing. Use only when stronger options are unavailable. |
| Email one-time code | Phishable | Microsoft identifies email OTP methods as increasingly vulnerable to interception and spoofing. Protect the email account itself with phishing-resistant MFA first. |
| Push approval | Phishable | Microsoft identifies push methods as increasingly vulnerable to spoofing and fatigue attacks. Repeated unexpected prompts should be denied and reported. |
| Manually entered one-time password | Phishable | NIST says manually entered OTP outputs are not bound to the session and are not phishing-resistant. |
Compare methods on more than convenience. Passkeys and FIDO2 keys score strongest on phishing resistance and resistance to credential relay. They require enrollment and a way to replace a lost authenticator, but they do not create the repeated approval fatigue associated with push prompts. SMS and email are familiar and easy to deploy, yet their codes can be intercepted or entered into a fake session. Number matching can reduce accidental approvals compared with a simple “approve” button, but it remains a fallback rather than the same assurance as a domain-bound cryptographic response.
CISA’s guidance is not to leave an account unprotected just because the service lacks a phishing-resistant option: any MFA is better than none. Turn on the strongest available alternative, then consider whether that account is important enough to move to a service that supports phishing-resistant authentication. The fallback is a risk reduction, not a reason to treat the account as equally protected.
Where should I set up passkeys first?
Start with accounts that can unlock or reset access to other accounts, then cover accounts where misuse would have serious financial, administrative, or operational consequences. Email is particularly important because it is often tied to password resets and account notifications.
- Email: protect the inbox and any account used to recover other logins.
- Financial accounts: use the strongest sign-in option offered for banking and other services involving money or sensitive financial information.
- Administrator accounts: prioritize accounts with permission to manage devices, users, or critical systems. Keep a separate hardware authenticator for administrative work where practical.
- VPN and critical systems: CISA specifically highlights these services for phishing-resistant MFA, especially in organizations.
- Other high-value accounts: include accounts whose compromise could expose sensitive data or provide a route to additional services.
For an organization, that includes considering the authentication requirements for employees and administrators rather than focusing only on consumer-facing accounts. Roll out enrollment instructions through a known internal channel, document the recovery process, and avoid making a single phone the only way an administrator can regain access.
How do I set up passkeys and keep a recovery route?
Enroll from the service’s official security page, not from a link in an unexpected email or message. Verify the domain before registering: passkeys protect against authentication on a malicious look-alike site, but that protection does not make it wise to begin enrollment on a site whose identity you have not checked.
- Open the account’s official security settings. Navigate there directly through the service’s known website or app. Look for its passkey, security key, or sign-in method settings.
- Register a passkey or FIDO2 key. Follow the service’s instructions and verify that you are on the genuine service domain before approving the registration.
- Add a second authenticator. Register two or more authenticators so losing or replacing one device does not automatically leave you without an access route. When practical, pair a platform passkey with a roaming or hardware FIDO2 key.
- Test the second authenticator. While you are signed in, confirm that the backup can actually complete a sign-in. A key left in a drawer without a compatible port, connector, or account enrollment is not a useful recovery plan.
- Store the backup authenticator securely. Keep a backup hardware key in a safe location separate from the device you use every day. Make sure you can identify which account it is meant to recover.
- Review the available recovery method. If your identity platform supports a Temporary Access Pass (TAP), Microsoft lists it as an option for secure onboarding and recovery. Use the platform’s own guidance for issuing and using one.
- Review active sessions and authentication methods. Revoke sessions you do not recognize, remove unused sign-in methods, and rotate an exposed password. Do not leave a lost device registered as a trusted authenticator.
- Keep the supporting software current. Update operating systems, browsers, and password managers so their passkey implementations can receive security fixes.
Multiple authenticators and a planned recovery route address different failure modes. A backup key can help if a phone is lost; removing the lost device and unknown sessions helps reduce the chance that an attacker continues using access already associated with the account. CISA recommends registering multiple authenticators to reduce loss and recovery risk.
Also popular on Amazon
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Do not make recovery weaker than the sign-in you are trying to protect. An account secured with a passkey can still be taken over if an attacker can persuade support staff to bypass the control or exploit an unprotected recovery email. Review which recovery addresses, phone numbers, backup codes, and trusted devices remain active, and remove anything you no longer control.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsShould I use a syncable or device-bound passkey?
The choice depends on the balance between convenient recovery and the assurance needs of the account. Syncable passkeys can make it easier to use credentials across devices and recover when a device is replaced. Device-bound or hardware-backed credentials keep the credential tied more closely to a particular authenticator and are preferred for the highest assurance.
NIST says correctly implemented syncable authenticators can provide phishing resistance, simplified recovery, and cross-device support. Syncability therefore does not automatically make a passkey phishable. CISA cautions that syncability introduces key-material risk that should be evaluated for the scenario and advises against syncable authenticators for AAL3. For the highest-assurance use cases, prefer device-bound or hardware-backed credentials and follow the applicable identity platform’s requirements.
For an individual deciding what to enroll, the practical trade-off is portability versus tighter control over where the credential resides. A syncable credential can reduce friction when changing devices, while a device-bound key may be a better fit where assurance requirements outweigh convenience. In either case, keep a separate recovery plan and enroll more than one authenticator.
What should I do if I lose my phone or security key?
Use another authenticator already registered to the account, such as a backup key or another enrolled device. Once access is restored, remove the lost authenticator from the account, review and revoke unfamiliar active sessions, and check that no unused or unrecognized authentication method remains.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallIf you have no working authenticator, use the service’s official recovery process rather than responding to unsolicited messages claiming to restore access. For supported identity platforms, a Temporary Access Pass may be available for secure onboarding or recovery. Do not treat an old SMS or email code as a substitute for a planned recovery route; fallback methods remain phishable.
After recovering the account, rotate passwords that may have been exposed and review other accounts that shared or depended on them. If the missing device may have been accessed by someone else, remove it promptly from the account’s registered authenticators and check for sessions or sign-in methods you did not add.
Also popular on Amazon
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What does MFA not protect against?
MFA improves account sign-in security, but the method matters. SMS, email codes, push prompts, and manually entered OTPs can still be phished or abused through interception, spoofing, or approval fatigue. A convincing message can still persuade someone to visit a fake site or approve an unexpected request; the advantage of passkeys is that a look-alike verifier cannot obtain a valid domain-bound response.
Authentication also does not replace basic account maintenance. Keep devices and the software that handles passkeys current, remove unused methods, review sessions, and protect recovery routes. If a password is exposed, rotate it as part of account cleanup rather than assuming MFA makes the password harmless in every circumstance.
Free tools Windows power users keep installed
One-click scans. No signup required.
Passkeys also do not automatically secure an account that is already signed in. Browser cookies, active sessions, delegated applications, and tokens may remain valid after a new authenticator is added. Review the account’s session and connected-app controls, revoke anything unfamiliar, and then reauthenticate with the trusted passkey or security key.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What do Microsoft’s 2026 figures show?
Microsoft reported AI-enabled phishing click-through rates as high as 54% versus roughly 12% for traditional campaigns in 2026. The comparison illustrates why defenders should reduce the value of a phished credential rather than rely only on users recognizing every message. It does not mean that every AI-assisted campaign has a 54% click rate or that every user faces the same odds.
Microsoft also reported that 92% of its employee productivity accounts were protected by phishing-resistant authentication in 2026 as part of its Secure Future Initiative. That is a reported figure for Microsoft employee productivity accounts, not a universal adoption rate or a promise that any MFA rollout will produce the same result.
Practical pitfalls to avoid
- Registering from a message link: an attacker may try to guide you to a fake security page. Open the known site or app yourself and check the domain.
- Keeping only one authenticator: a lost phone, damaged key, or account replacement can become a lockout. Enroll at least two.
- Leaving old devices active: remove a lost, sold, or retired device and revoke its sessions.
- Calling every MFA method equivalent: SMS, email OTP, push, and manually entered codes remain phishable even though they add a factor.
- Ignoring syncability requirements: convenience may be appropriate for ordinary accounts, while AAL3 and other high-assurance scenarios call for device-bound or hardware-backed credentials.
- Forgetting recovery: a passkey cannot help if the only enrolled device is unavailable and no official recovery route exists.
Frequently Asked Questions
How do I stop AI phishing from stealing my password?
Use a passkey or FIDO2/WebAuthn security key on the account’s official security page. Its response is bound to the real domain, so a look-alike site cannot collect a valid authentication response. Keep software current, review sessions, and use the strongest available MFA on services that lack passkeys.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Are passkeys safer than SMS codes?
Yes for phishing resistance. Passkeys use a domain-bound cryptographic response; SMS codes are manually transferred and can be intercepted, spoofed, or entered into a fake session. SMS is better than no MFA, but it is a fallback rather than an equivalent control.
Also popular on Amazon
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Do passkeys count as MFA?
They can when the device-held credential is unlocked with a PIN or biometric, combining possession with a local unlock factor. The service’s own policy determines whether that enrollment satisfies its MFA requirement.
What should I do if I lose my phone or security key?
Use another authenticator already registered, such as a backup FIDO2 key. Then remove the lost authenticator, revoke unfamiliar sessions, review authentication methods, and use the service’s official recovery process. A supported identity platform may offer a Temporary Access Pass for secure recovery.
Can I use the same passkey on more than one device?
That depends on how the passkey is stored and synced. NIST says correctly implemented syncable authenticators can support cross-device use while remaining phishing-resistant; high-assurance environments may instead require credentials that are device-bound.
Are passkeys safer than a password manager’s saved password?
Passkeys resist phishing by binding authentication to the registered domain, while password and code methods can be phished. The exact comparison depends on the password manager, account configuration, and recovery controls.
What is a Temporary Access Pass used for?
Microsoft lists a Temporary Access Pass as a time-bound credential for secure onboarding and recovery on supported identity platforms. Availability and the steps for issuing one depend on the organization’s platform configuration.
Does a passkey stop someone from taking over an account that is already signed in?
Passkeys protect the authentication step described here; they do not by themselves revoke an existing session. Review active sessions and revoke ones you do not recognize, especially after losing a device or suspecting account compromise.
The Bottom Line
AI makes convincing phishing easier to scale, so protect the authentication response instead of relying only on message detection. Put passkeys or FIDO2 security keys on your highest-value accounts, enroll at least two authenticators, and keep a tested recovery route. Where passkeys are unavailable, use the strongest MFA offered while treating SMS, email codes, push approvals, and manually entered OTPs as phishable fallbacks.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
