Convenient sign-in is not enough
Signing in is convenient: confirm the request and you are in. When the familiar phone goes missing, the quality of the whole access design becomes apparent. Someone locked out of a customer account needs a dependable route back, not a general marketing claim about security.
To me, that is not an argument against passkeys. It is an argument against calling sign-in finished after the first successful login.
What is changing now
The FIDO Alliance published its Passkey Index 2026 on 15 October 2026. The accompanying account identifies 15 participating major consumer services. Its findings describe their usage, not a representative sample of every internet sign-in. [1][2]
The development matters because an optional feature is becoming an everyday means of access. Device loss, account management and support when something fails consequently matter more too.
A passkey is not simply a phone
FIDO distinguishes synced and device-bound passkeys. Depending on the provider, a synced passkey may be available on other devices you own; a device-bound credential stays with its device or security key. [3]
I would therefore first establish where the credential is actually stored. “I sign in using my phone” does not mean losing that phone necessarily removes every way in. Equally, I would not assume that synchronisation alone constitutes a complete recovery plan.
Prepare before replacing the device
I would treat replacing a device as a planned handover. Before resetting the old one, check which accounts have another configured sign-in method and confirm that it works. Keep the old device available until the handover is confirmed, provided it is still present and trustworthy.
For especially important accounts, I would deliberately prepare an additional method supported by the service. A security key helps only if it has already been registered for that account. It cannot retrospectively unlock arbitrary accounts. Recovery depends on the service and passkey provider. [3]
What good account management should provide
A clear overview should show which credentials have been registered. I would expect understandable names, support for additional passkeys and a controlled way to remove credentials no longer needed. FIDO explicitly identifies limiting an account to one passkey as a problematic design pattern. [2]
An interface should not claim more than it knows. A displayed name is not necessarily a complete inventory of every synchronised copy. Removing a passkey at the service, locking a device and ending existing sessions are also separate tasks.
Recovery must not become a back door
When designing recovery, I would ask not only how the user gets back in, but how someone else is prevented from abusing that route. A weak alternative can undermine a strong sign-in method.
For a customer portal, I would examine lost devices, unreachable contact addresses and loss of every configured credential as separate cases. Support teams need clear procedures, not improvised decisions based on who sounds convincing. Confidential recovery information does not belong in ordinary support messages.
My conclusion
Good sign-in keeps attackers out without leaving legitimate users stranded. Passkeys are one part of that; account management and recovery belong to the same product.
These suggestions do not replace provider-specific instructions. If a device is lost, the affected services' current locking, session and recovery procedures apply. They do not amount to a universal security guarantee.
Sources and context
Research date: 23 October 2026. Vendor publications are not independent product tests. Examples and recommendations are identified as such in the article.
[1] FIDO Alliance: Passkey Index 2026, 15 October 2026
Read source ↗
[2] FIDO Alliance: adoption and design guidance, 15 October 2026
Read source ↗
[3] FIDO Alliance: passkeys and frequently asked questions
Read source ↗