If you've signed in to Google, PayPal or your Microsoft account lately, you've probably been asked whether you'd like to "create a passkey. In April, the National Cyber Security Centre (NCSC) said it will recommend passkeys wherever they're available. Where they aren't, it recommends two-step verification (2SV), also known as multi-factor authentication (MFA). Take-up is already strong: around half of UK Google users have registered at least one.
What is a passkey?
A passkey replaces your password with a pair of digital keys. One key (the public key) is stored by the website. The other (the private key) stays on your device or in your password manager and never leaves it. When you log in, you unlock it the same way you unlock your phone, with your face, fingerprint or PIN, and your device proves who you are without sending anything an attacker could reuse.
Think of a passkey as a key cut for one specific front door. If a fraudster builds a convincing fake door (a phishing website), your key simply won’t turn, because it only works with the real one. There’s nothing to type, so there’s nothing to hand over.
Why they're so good at stopping phishing
Each passkey is tied to the genuine website it was created for. Your device checks the web address before it will use the passkey. If you land on a convincing fake login page, there's nothing to hand over. There's nothing to type and nothing to steal.
This matters because criminals have become very good at stealing one-time codes. Some phishing kits sit between you and the real website and pass on your password and code in real time, so the criminal is logged in seconds after you. Passkeys stop this. The NCSC's own assessment is that even under realistic conditions, passkeys give stronger protection than the best traditional MFA.
There's no password to reuse across sites, and if a website is breached, your passkey can't be used elsewhere. They're also quicker than fiddling with codes.
The catch? Passkeys have weak spots too
Think of a passkey as a high-security lock on your front door. It's excellent. But if there's still a spare key under the doormat, a burglar won't bother with the lock.
For most online accounts, the spare keys look like this:
• Your old password. Many services keep your password working alongside your passkey. A fake login page simply asks for the password instead or shows a "try another way" button.
• Text and email codes for account recovery. If "lost your passkey?" sends a code to your phone or inbox, your account is only as secure as those. Criminals can persuade a mobile network to move your number to their SIM card (SIM swapping), or they may already have access to your email.
• Calls to customer support. Some attackers ring the helpdesk pretending to be you and ask for a reset. Helpdesk social engineering has been behind some of the biggest UK cyber-attacks of the last couple of years.
Once inside, an attacker can add their own passkey to your account. That gives them a quiet way back in, even after you've changed your password.
Where your passkeys are kept matters
Most passkeys are synced through your Apple, Google or Microsoft account, or a password manager. This is convenient, because when you replace your phone, your passkeys come with you. But it also means that one account becomes the key safe for everything. Apple and Google encrypt your passkeys, but someone who gets into that account and knows your device passcode could get a long way.
Your phone's passcode matters more than ever. If someone watches you type it on a train, they're part of the way there.
Passkeys protect the login, not what happens after it
After you sign in, a website gives your browser a session "ticket”, so you don't have to log in on every page. Malicious software (malware) on your device can steal that ticket and skip the login altogether. A passkey can't help with that, which is why applying security updates and careful downloading are still vital.
Why this matters to financial advisers
Your personal email, phone number and Apple or Google account are often the route into everything else. They reset other accounts, they hold your contacts, and they're frequently on the same phone as your work apps. A compromised personal email can be used to send convincing messages to clients in your name, and clients are unlikely to question an email that really did come from you.
How to protect yourself
• Switch on passkeys where they're offered, and app-based MFA where they're not. Start with your email, your Apple, Google or Microsoft account, and your financial platforms.
• Lock down the account that syncs them. Your Apple Account, Google account or password manager now holds the keys to everything, so protect it with the strongest login it offers (ideally a passkey itself) and check the recovery email and phone number are up to date.
• Check your recovery options. Where a service lets you, remove SMS or email codes as a recovery route once your passkey is set up, or at least secure the email account and mobile number they rely on.
NB: don't remove every recovery option without a backup in place. Losing all your devices with no way back in can lock you out for good.
• Treat your phone like a set of house keys. Use a longer passcode rather than four digits, and switch on Stolen Device Protection (iPhone) or theft protection (Android). Make sure you know how to remotely lock and wipe your phone before you need to.
• Set up a backup. Add a second passkey on another device or print your recovery codes and keep them somewhere safe, not in your inbox.
• Ask your mobile network about a PIN or password on your account. This makes it harder for someone to move your number to a new SIM.
• Treat unexpected codes and alerts as a warning. A reset code you didn't ask for, or a "new passkey added" email, could mean someone is trying to get in. Never read a code out to anyone who calls you, however convincing they sound.
• Review your devices and passkeys every few months and remove anything you don't recognise.
• Keep your phone and computer updated and remove browser extensions you don't use.
When a service doesn't offer passkeys yet
Passkeys aren't available everywhere yet, and many well-protected services still use other methods. For those, the NCSC recommends a password manager for stronger passwords, alongside multi-factor authentication (MFA). Not all MFA is equal, though. A code sent by text can be intercepted through SIM swapping, while an authenticator app on your phone avoids that risk.
That's the approach we take at Parmenion, and you can enable MFA on your Parmenion account by downloading the Parmenion app. As this article shows, the login is only one part of keeping an account safe. Behind it, we use layered controls, including additional checks on high-risk actions such as changing bank details and withdrawals, and we monitor accounts continuously. If we spot something unusual, such as logins from several locations in a short space of time, we'll contact you directly.
Whichever app you use for MFA, the same rules apply. Never approve a sign-in prompt you didn't start yourself and never share a code with anyone who contacts you, however genuine they seem.
Key takeaway
A passkey is only as strong as the weakest way back into your account. Set them up, then spend ten minutes checking what’s under the doormat. It only takes a few minutes and is well worth your time.
References:
[1] NCSC – Passkeys are more secure than traditional ways to log in: https://www.ncsc.gov.uk/blogs/passkeys-are-more-secure-than-traditional-ways-to-log-in
This article is for financial professionals only. Any information contained within is of a general nature and should not be construed as a form of personal recommendation or financial advice. Nor is the information to be considered an offer or solicitation to deal in any financial instrument or to engage in any investment service or activity.
Parmenion accepts no duty of care or liability for loss arising from any person acting, or refraining from acting, as a result of any information contained within this article. All investment carries risk. The value of investments, and the income from them, can go down as well as up and investors may get back less than they put in. Past performance is not a reliable indicator of future returns.
