Passkeys: The Business Login That Cannot Be Phished

A staff member opens an email that looks like a Microsoft sign-in page. She types the password, approves the prompt on her phone, and the page loads.

The sign-in worked. The page belonged to an attacker, who now holds a live session inside the company mailbox.

A passkey closes that gap. The credential is held inside the device, and it will hand nothing over to a website it does not recognise.

This is how most New Zealand business email accounts are taken. The attacker reads the mailbox for a fortnight without touching anything, waits for a real invoice to go out, changes the bank account number on it and sends it on.

Take an illustrative example of what that costs. A redirected supplier payment of $18,000, which is an ordinary month on a trade account, is gone before anyone notices, and the customer who paid it is usually the one who tells you.

Every control bolted on top of the password exists because the password itself can be copied. Take the password away and several of those controls have less work to do.

Owners tend to expect the fix to be a bigger security product. What changes is the credential, and the work comes down to which accounts move first and what the help desk does when a phone goes missing.

What Are Passkeys?

A passkey replaces the password with a private key that lives in the device. That key is protected by the hardware inside the phone or laptop, and it is released only after the person unlocks it with a face check or a fingerprint.

The nearest everyday comparison is a modern car key. The chip inside it talks to the car, so a locksmith who copies the shape of the blade still cannot start the engine.

The private key never leaves the place it was created, and it is never sent to the website. What travels is a signature proving the key is present.

The site holds only the matching public key. A stolen copy of that public key is worth nothing to an attacker, because a public key cannot produce a signature.

How do passkeys work?

A passkey works by proving the device holds a private key, without that key ever being sent. The site issues a random challenge, the device signs it with the private key, and the site checks the signature against the public key it stored at registration.

The whole exchange takes about three seconds. All the person sees is a face scan or a fingerprint.

The credential is built on FIDO2, short for Fast Identity Online version 2, which is the standard family behind passwordless sign-in. FIDO2 has two halves: WebAuthn, the Web Authentication API that browsers speak, and CTAP, the Client to Authenticator Protocol that lets a phone or a security key answer on behalf of a laptop.

Neither half belongs to a single vendor. Both are published standards that every current browser and operating system already implements, so the same credential works on a Windows laptop and on an iPhone.

What is stored on the device?

One key pair for each site, and nothing else. A passkey created for your bank cannot be used at your accounting platform, because the key is bound to the exact web address it was registered against.

That binding is what people mean when they call a passkey origin-bound. The device checks the address before it will sign anything, so a lookalike domain fails at that check.

What is the difference between a passkey and a saved browser password?

A saved browser password is still a password, sitting in a file the browser can read and an infostealer can copy. A passkey is a private key held in hardware, and the browser can ask for a signature without ever seeing the key itself.

The difference shows up when a laptop is stolen or a stealer trojan runs. A saved password walks out of the machine in a text file. Lifting a passkey means breaking the secure hardware first.

Autofill hides the distinction, because both feel like one click to the person signing in. Saved passwords are what show up in breach dumps.

Where does a passkey live?

In one of three places, and the choice decides how the business handles a lost device.

• A device-bound passkey is created inside the phone or laptop and can never leave it. A hardware security key on a keyring works the same way. The key stays in your hand.
• A synced passkey is encrypted and copied between a person’s own devices through the account that already links their phone and laptop, so a replacement machine inherits what was registered.
• A password manager that supports the standard holds them alongside the logins a team already shares, and it covers the sites sitting outside the Microsoft tenant.

Most small businesses end up with a mix. Administrators get device-bound credentials on hardware keys, everyone else gets a synced passkey on their phone, and a password manager catches the sites the platform does not cover.

Can Passkeys Be Phished?

No. A passkey checks the web address before it will respond, and a fake login page is not the address it was registered against. There is also no code for the person to hand over, since the sign-in involves typing nothing at all.

That matters commercially, because every alternative can be relayed. A password, a one-time passcode and an approval tap all pass through somebody sitting between the staff member and the real site.

What is an attacker-in-the-middle attack?

An attacker-in-the-middle attack, often shortened to AiTM, puts a proxy server between the person and the genuine login page. The proxy passes every keystroke and every code straight through, then captures the session cookie that comes back.

The attacker walks in with a valid session and never needs the password again. Kits that do this are sold ready to run, and they defeat one-time passcodes and push approvals without breaking either of them. None of it takes much skill.

The NCSC lists codes sent by SMS as easy to bypass and considered deprecated by the industry, and warns that one-time passcodes generated in a mobile app are vulnerable to phishing and social engineering.

A passkey stops the proxy at the first step. The signature it produces is tied to the address in the browser, and because the proxy sits on a different address, the real site rejects the sign-in.

Does a passkey stop credential stuffing?

Yes, on any account where the password has been switched off. Credential stuffing works by replaying username and password pairs harvested from old breaches against thousands of sites at once, and an account with no password on it cannot be tested that way.

That protection only arrives at the end of the project. An account carrying a new credential alongside a live password is still exposed to every breach list that password appears on. Switching the password off is the step that delivers the benefit.

Can malware steal a passkey?

No, at least not by copying one. Pulling a device-bound private key out of a phone means defeating the secure hardware holding it, which is a different order of effort from reading a saved password out of a browser profile.

Malware on a compromised device can still abuse a session that is already open. Device health and session controls stay part of the picture after the credentials change.

The ladder above places each login method by how hard it is to steal. Only the top band counts as phishing-resistant. The detail of how each factor is chosen and managed sits with multi-factor authentication.

Do Passkeys Replace Multi-Factor Authentication?

Yes, on the accounts where a passkey is enabled. A passkey carries two factors in one gesture, because it combines something the person has, the device holding the key, with something they are or know, the biometric or PIN that unlocks it.

That is why a passkey counts as strong authentication on its own. NIST Special Publication 800-63B requires phishing resistance at authenticator assurance level 3, the highest of the three levels it defines, and a passkey is one of the few credentials that qualifies.

In practice most businesses run both for a while. The new credential goes on the accounts that matter while the existing multi-factor setup keeps covering everything else, and the two sit in one Microsoft Entra ID tenant without any special work.

Deciding which accounts are forced onto which method is a policy setting, and it lives in the same place as every other access rule under identity and access management.

Which Accounts Should Move to Passkeys First?

Administrator accounts first, then anything that moves money. The order matters because a rollout runs over weeks and the accounts at the top of the list are the ones an attacker is already aiming at.

1. Microsoft 365 global administrator accounts. These control every mailbox and every file in the tenant, there are usually fewer than five of them, and the change takes an afternoon.
2. Finance and banking logins. Online banking, the payment approval tool, and anything that can change a supplier’s bank account number.
3. The accounting and payroll platform. Payroll holds bank accounts, IRD numbers and salaries for every person on staff, and it is the account a fraudster wants most after the mailbox.
4. Everyone else, in team-sized groups. Start with the team handling the most external email, because that is where the phishing arrives.

What about accounts that cannot use a passkey yet?

Leave them on their current setup and put them on a written list. Bank portals and older line-of-business software are the usual holdouts, and the list is worth reviewing every six months as vendors add support.

The list matters for a second reason. An account still using a password is the one an attacker will look for once the obvious targets have moved.

What Happens If You Lose the Phone With Your Passkey?

You sign in with a second passkey on another device. Register two for every person, before either one is needed, because where no second credential exists the only route back is the help desk.

Account recovery is the part of a passkey project that gets skipped and then costs the most. A credential that cannot be phished is still reachable through a help desk that will reset it for anyone who sounds convincing.

How many credentials should each person register?

Two, on separate devices, registered in the same sitting. A passkey on the phone and a second on the laptop covers a lost phone and a screen that stops responding. Registering both takes about ten minutes.

Who can approve a passkey reset?

A named person inside the business, verifying the request on a channel separate from the one it arrived on. For a small team that means a phone call to a number already in the staff directory.

Write the process down before the rollout starts. Three lines in a document is enough, as long as the person answering the phone has read them.

• Two credentials for each person, on different devices, registered at the same sitting.
• One hardware security key held in the office safe for the administrator accounts.
• A written verification step the help desk follows before any reset is approved.
• A record of which accounts each person holds a passkey for, so a departure closes all of them.

Talking a help desk into a reset is the same trade as talking a staff member into a fake login page, and the tactics are set out in phishing scams.

Test the process once before go-live. Have somebody the help desk knows ring in and ask for a reset they are not entitled to, then see what happens.

What Do Passkeys Not Protect Against?

Anything that happens after the sign-in. Once a session is open, malware on the device and any mailbox rule left behind by an earlier compromise behave exactly as they did before.

This matters where a business treats the rollout as the end of its security programme. The credential is one control among several, and the project is a good moment to check the rest of them.

• A device that is already infected can have its open session hijacked, so endpoint protection and patching still apply.
• Forwarding rules and app consents left behind by an older compromise survive a credential change, so they need clearing as part of the project.
• Shared mailboxes and service accounts often cannot hold a passkey at all, and they need their own treatment and their own review date.
• Data a person can legitimately reach stays reachable, which belongs to permissions where it always did.

None of that argues against the change. It argues for booking the clean-up into the same fortnight, while somebody is already in the admin console.

How Much Do Passkeys Cost a Small Business?

Very little in licensing and a few days in setup. The passkey method is built into Microsoft Entra ID, so a business already on Microsoft 365 is not buying a new product to use it.

The spend sits in people’s time and in a small amount of hardware. The figures below are indicative ranges for a South Island business of about 30 staff. Scale them by headcount.

How much does a passkey rollout save?

About 280 hours a year in an illustrative 30 person business. Roughly 30 of those are help desk hours and the rest is time staff spend at the sign-in screen.

Help desk time first. Thirty staff raising four password resets each across a year, at fifteen minutes of provider time per ticket, is 30 hours of billable work that mostly disappears once nobody has a password to forget.

Then the sign-in itself. Microsoft measures a synced passkey sign-in at 3 seconds against 69 seconds for a password plus a traditional prompt, and across 30 staff signing in twice a working day that gap is about 253 hours a year, or near enough to $11,000 at $45 an hour.

The largest saving never appears on an invoice at all. It covers the supplier payment that does not get redirected and the week of clean-up nobody has to do.

How Do You Roll Out Passkeys Without Disrupting Staff?

Register the second credential before you remove the first. Move one team at a time. A passkey rollout goes wrong in only one way, which is taking the password off an account before the replacement has been proven on it.

Registering one credential takes about four minutes. Allow fifteen minutes a head for the session, because the questions take longer than the clicks, and put the planning into the order and the fallback.

• List every system the business signs in to and mark which ones accept a passkey. Most rollouts skip this and discover the gaps halfway through.
• Enable the passkey method in the tenant and target a pilot group of five people.
• Run a fifteen minute session where each person registers a passkey on their phone and a second on their laptop.
• Watch the pilot for a fortnight and collect every site that refused a passkey.
• Move the administrator accounts, then finance, then the rest of the business in team-sized groups.
• Turn off password sign-in for the accounts holding two working credentials, and leave the others until they do.

The pilot is where the surprises show up, and five people is enough to find them. A fortnight also covers the person who is away for a week.

What do staff need to know before the session?

Two things, and a short email covers both. Signing in will use their face or fingerprint. They will also register a second credential on another device before the old password is switched off.

The biometric question comes up in every session. The phone checks the face scan or fingerprint against data already stored on the phone. Nothing about the person’s face or finger reaches the company.

Cover that in the first two minutes of the session. Otherwise it comes back fifteen times.

What should you do this week?

Count your Microsoft 365 global administrator accounts and check whether any of them still signs in with a password and a code. If the answer is yes, that is the smallest high-value change available to the business.

Then ask whoever answers the phone what they would do if a staff member rang from an unknown number asking for a login reset. If the honest answer is that they would just reset it, the recovery process is the first thing to write down.

Move Your Riskiest Logins Off Passwords

Exodesk has supported South Island businesses since 1989 and works with organisations across Canterbury, Otago and Southland from offices in Christchurch and Dunedin. We enable passkeys in Microsoft 365, register staff in groups and write the recovery process the help desk follows. Our cyber security services cover the controls sitting around the credential.

Contact us today to discuss how we can help your business or connect with us on LinkedIn to stay updated with more insights.

Frequently Asked Questions

What is a passkey in simple terms?
A passkey works like a digital key your phone or computer keeps for one particular website. Signing in means unlocking that key with your face or your screen lock, and the site checks the key without anything being typed that an attacker could catch.

Are passkeys safer than passwords?
Yes. A password can be typed into a fake site, guessed, or read out of a breached database. A passkey does none of that, because it is never typed and never leaves the device. The site only ever receives a signature proving the key is present.

Do passkeys work offline?
Passkeys need a connection to the site you are signing in to, in the same way a password does, so an internet outage stops both. The unlock happens on the device itself, so no separate authentication server has to be reachable for the gesture to work.

Can passkeys be used on a shared computer?
Yes. Staff sharing a front desk machine can each sign in using the passkey held on their own phone, by scanning a QR code shown on the shared screen. That keeps individual accountability on a device several people touch.

What is FIDO2?
FIDO2, short for Fast Identity Online version 2, is the open standard set that passkeys are built on. The name covers two pieces: a browser interface called WebAuthn and a device protocol called CTAP. Neither is owned by one company. Support ships in every mainstream browser and operating system as standard.

Do you still need a password after moving to passkeys?
Most businesses keep the password for a transition period, then disable password sign-in once two passkeys are registered and working on the account. Leaving the password enabled forever keeps the phishable route open and undoes most of the benefit.

How long does it take to set up passkeys for a team of 20?
About two weeks end to end for a team of 20, and roughly fifteen minutes of each person’s time. The tenant configuration takes an afternoon, the pilot group runs for a fortnight, and the remaining staff register in group sessions. The recovery process should be written before any of that begins.

Do passkeys cost extra in Microsoft 365?
No separate licence is required. The method ships inside Microsoft Entra ID, so an organisation holding any current Microsoft 365 subscription can turn it on. Budget instead for the rollout hours, a handful of hardware keys for administrator accounts, and a vault subscription if sites outside the tenant need covering.

Can a passkey be copied to another device?
The answer depends on which of the two types you registered. Synced credentials travel between the devices signed in to one Apple, Google or Microsoft account, which is how a replacement laptop picks them up. Device-bound credentials, including anything held on a physical security key, stay on the hardware that made them.

Do passkeys work on iPhone and Android?
Yes. Passkeys work on iPhone and Android phones as well as on Windows and Mac computers, with each platform storing them in its own keychain or password manager. A credential registered on one platform will not automatically appear on another, so a person using an Android phone and a Windows laptop registers one on each. Mixed devices are the normal case in a small business, and the rollout treats them no differently.

Will passkeys work with our accounting and banking systems?
Some will and some will still be waiting, and the picture moves every few months. Major cloud platforms have added passkey support, while several banking and payroll portals continue to run their own token or app. Record the holdouts during the pilot and leave those accounts on their existing setup until support arrives.

Can a Christchurch or Dunedin business get help rolling out passkeys?
Yes. Exodesk works with businesses across Canterbury, Otago and Southland from offices in Christchurch and Dunedin, and has operated in the South Island since 1989. Enablement, registration sessions and the recovery process are handled remotely, with on-site visits where a team would sooner register together in one room.

Where should a business start with passkeys?
Start with the Microsoft 365 global administrator accounts, because there are usually only a handful and they carry the most damage. Register two passkeys on each of them, then write down who may approve a reset and how that person verifies the caller. Those two steps take an afternoon and make the rest of the rollout routine.