A passkey-themed message can still trick you into granting access
Separate passkey protection from social engineering, verify security changes in the account and review newly registered authentication methods.
In brief
Microsoft reports passkey-themed social engineering leading to identity and cloud compromise. Using the word passkey in a message does not make its requested account change trustworthy.
Passkeys can resist phishing in their supported sign-in flow, while an attacker may still persuade someone to approve another access route.
Verify the requested change
Ask whether you intentionally started adding a passkey or device. Read the actual application and permissions shown by the service. A caller telling you to approve a prompt for your protection can be trying to obtain access, even if the prompt is genuine.
Review persistent access
Inspect unfamiliar MFA methods, passkeys, recovery addresses and application grants. A password change alone may not remove every registered method. Keep a legitimate recovery route before removing an old credential you do not immediately recognize.
Use the incident evidence
Follow the provider’s compromised-account checks if activity was not yours. Preserve the suspicious request and timing. Keep using appropriately configured strong authentication; do not replace it with weaker access because a campaign borrowed its name.
Before you act
This is not evidence that passkeys are universally broken. Inspect the actual consent, registration and session events rather than attributing every account problem to the authentication technology.
What to do next
- Open account security directly rather than a message’s “upgrade security” link.
- Review newly added authentication methods, apps and sessions against actions you initiated.
- Remove unauthorized access through official recovery, involving the administrator for managed accounts.
