The Recovery Desk Is Where the Passkey Promise Goes to Die

Passkeys have become the security industry's favorite story about itself. They are phishing-resistant, bound to a device, immune to credential stuffing, and indifferent to the password dumps that fuel so much online fraud. All of this is true, as far as the mathematics goes. But a login page is not the only entrance to an account, and the industry's enthusiasm tends to stop exactly where the cryptography ends and the human beings begin.

The Claim, Stated Fairly

Passkeys replace a shared secret with a cryptographic key pair. The private half stays on a device or in a synced keychain; the public half sits with the service. There is no string for a user to type into a lookalike page, which is why the FIDO Alliance and a growing roster of banks, retailers, and cloud providers describe passkeys as phishing-resistant rather than merely phishing-aware. The claim is defensible. A stolen passkey is close to useless to whoever steals it.

What the claim does not address is everything that happens after a customer loses the device, drops it in a lake, upgrades a phone, or simply cannot remember which account holds the credential. That is the recovery desk's job, and the desk was designed before any of this existed.

The Door Nobody Replaced

Account recovery exists because devices break. The department that handles it is staffed by people working long queues against tight handling-time targets, often reading from scripts, often empowered to make consequential changes on the strength of a short conversation. An attacker who cannot defeat the cryptography can simply ask a human to set it aside — and the ask is not difficult to make plausible.

This is not a theoretical weakness. The July 2020 Twitter breach, in which young attackers gained access to internal administrative tools through phone-based social engineering of employees, remains the canonical American example. The 2023 intrusions against major casino operators leaned heavily on help-desk calls rather than technical exploits. In each case, the perimeter was not picked; it was talked open.

The Script an Attacker Actually Runs

A typical approach opens with a story about travel, a lost phone, and an urgent need to reach a business account. The caller offers verification data readily: a date of birth, a street address from three moves ago, the last four digits of a Social Security number, the amount of a recent transaction. Much of that information circulates freely after breaches and is available in data broker files. To the representative on the line, the caller sounds like a customer who knows things only a customer would know. To anyone examining the pattern across a thousand calls, it looks like a checklist being read aloud.

Once the recovery email is changed or a new device is trusted, the passkey becomes decoration. The attacker is inside, and the customer is outside looking at a login screen that no longer recognizes them.

What Competent Recovery Looks Like

Several practices separate banks that have thought about this from banks that have not. A cooling-off period before a recovery email or phone number can be changed, with notification sent to the old contact method, gives a real customer time to raise an alarm. Rate limits and anomaly detection on recovery attempts catch scripted campaigns. Requiring video or in-person verification for high-value changes raises the cost of a phone call. Customer-held recovery keys, clearly explained and stored offline, provide a path that does not depend on a stranger's judgment. And a customer-visible log of recovery events turns an invisible process into an auditable one.

Questions Worth Asking Before You Enroll

Passkey enrollment is usually a five-minute flow through an app. The recovery policy is buried somewhere else entirely, and it is the part that determines how much protection you have actually purchased with your convenience. Ask what it takes to change the recovery email, whether there is a waiting period, and whether the old address is notified. Ask whether support staff can remove a passkey on request. Ask whether more than one passkey can be registered, so a lost phone does not become an emergency. Ask whether a hardware security key is supported. A bank that cannot answer these questions has not finished the project, whatever its marketing says.

Not an Argument Against Passkeys

The conclusion here is not that passkeys are worthless. They close the most common attack path in consumer security, and they close it well. The conclusion is that threats move toward the weakest available link rather than disappearing, and strong authentication pushes pressure onto identity verification, which is performed by people under time pressure using information that is widely available for purchase.

The login screen got harder. The phone number on the bank's website did not.