Passkey and MFA Security: As the Technical Lock Gets Stronger, Attackers Turn to People

A passkey is an authentication method that lets you sign in with cryptographic keys stored on your device instead of a password. It is far more resistant to phishing than passwords and classic MFA codes. But as the technical lock gets stronger, attackers turn to the human layer: fake support calls, scenarios that get users to add a new device, and methods that trick users on the real login page. In this article we explain why MFA alone is no longer enough and what to watch for in the passkey era.

Why MFA alone is no longer enough

For a long time MFA was seen as one of the most important security controls. It is still a basic control, but attackers have found several ways around it:

• Fake pages that steal sessions: some tools send the user to a copy of the real login page, intercept the password and MFA code, and take over the session.
• Weak fallback methods: if the account has a weak fallback sign-in method such as SMS or a password, attackers go after it. This is called an MFA downgrade attack.
• Asking for the code directly: in fake support calls or live chats, the attacker asks the user for the code. Once the user hands it over, MFA offers no protection.
• Less protected applications: everyone protects their Microsoft and Google accounts. The dozens of other applications your team uses every day are usually less well protected.

Marsh McLennan's 2025 Cybersecurity Signals report also shows that MFA, now present in almost every organisation, no longer makes a difference on its own. Phishing-resistant MFA is what does.

What do passkeys solve?

Microsoft announced Entra passkey support on Windows in March 2026 and made it generally available at the end of April 2026. Users can now sign in to corporate applications with Windows Hello, without a password and in a phishing-resistant way. Passkeys make credential theft much harder, because:

• There is no password to share or write down.
• The key only works with the right website and is useless on a fake page.
• There is no password database on the server to steal.

Moving to passkeys is the right step. It is not a complete solution.

The weak points sit around the passkey

Three separate studies published within one week in August 2026 point to the same conclusion: the passkey itself holds, while the systems around it can fail. The researchers bypassed authentication by exploiting weaknesses in Windows, Chrome and cloud synchronisation.

These scenarios have one condition: the attacker must already have access to the device. So if device security is weak, a passkey alone is not enough either.

New attacks expected in the passkey era

Once passwords disappear, deceiving people becomes more valuable. Expected new attack methods:

• The "you've lost your device, let us help" scenario: abusing the account recovery process through help desk impersonation.
• Adding a passkey to a new device: a legitimate-looking flow in which the user authorises the attacker's device.
• Weak PINs and lost devices: a simple device PIN combined with the loss of the physical device.

The first cases: device-code phishing

According to Microsoft's research, attackers are using a method called device-code phishing:

1. The attacker starts an authentication request on their own device and receives a code.
2. They give the victim the code: "Enter this code to complete your passkey registration."
3. The victim enters the code on Microsoft's real login page.
4. The moment they do, they unknowingly authorise the attacker's device on their own account.

There is no fake page in this method. The user is on the real page, carrying out a real action. Because passkeys are still new to most users, it is easy to assume "this is a normal step".

Groups that call employees on their personal phones and steal their details with the pretext of "passkey setup for an urgent security update" have also been reported.

What should organisations do?

1. Move to passkeys, and stay alert. Passkeys improve security; the need for awareness remains.
2. Tighten account recovery processes. The help desk's identity verification steps can be the weakest link.
3. Strengthen endpoint security. A passkey is only as secure as the device it is stored on.
4. Remove weak fallback sign-in methods. If fallbacks such as SMS and passwords remain, attackers will target them.
5. Explain the new process to employees. Teach them how passkey setup works and that nobody will ask for a code over the phone.

Frequently asked questions

---
InfoLore adds the new attack patterns that emerge as technology changes to its awareness programmes. Get in touch to plan the user side of your passkey rollout together.