Passkeys, Passwords and Two-Step Verification: Improve Security Without Losing Your Recovery Route

An account’s security is not only the method used on a normal day. It also includes what happens when a device is lost, a number changes or a sign-in request appears unexpectedly.

Passwords, passkeys and multifactor authentication are related tools, not interchangeable names. A password is a secret entered to authenticate. Multifactor authentication adds another kind of verification. A passkey uses a different authentication mechanism supported by participating services.

The FIDO Alliance’s passkey overview explains the technology and its phishing-resistant design. That protection does not make every message or request received after signing in trustworthy.

Start with the account that protects the others

Email often supports password resets and security notices, so review its settings carefully. Use the provider’s official security page rather than following an urgent link in an unsolicited message.

Where a password remains necessary, avoid reusing it across unrelated services. A reputable password manager can help maintain distinct credentials without relying on memory alone.

Enable an appropriate additional verification method where offered. CISA’s guidance on multifactor authentication describes why adding verification strengthens account protection. Available methods differ, so use the provider’s instructions for the actual setup.

Understand recovery before changing devices

Check whether a passkey is available through a synced provider, a specific device or a hardware security key. The recovery path depends on the arrangement; do not assume that every passkey will appear automatically on a new phone.

Keep recovery codes or other approved recovery material securely, following the service’s instructions. A screenshot stored only on the phone you might lose is not a complete recovery plan.

Before removing an old device or verification method, confirm that the replacement works and that recovery information is current. Avoid creating a lockout while trying to improve security.

Treat unexpected prompts as a question

Do not approve a sign-in simply because repeated notifications are irritating. If you did not initiate it, review the account through its official application or website.

Never share a one-time code with a person claiming to need it for support or delivery. A convincing explanation does not change what the code authorises.

The aim is a combination you can use safely and recover responsibly. Stronger authentication is most effective when paired with clear habits: verify the destination, understand the prompt and keep a recovery route that does not depend on one fragile device.

Rehearse a lost-phone scenario safely

Before removing an existing sign-in method, confirm that the new one works and that you understand the service’s recovery process. Keep a trusted signed-in device available while checking. Do not deliberately lock yourself out to “test” security.

For each important account, record which device or provider holds the passkey, whether it is synchronised, and which legitimate recovery options remain. A hardware security key and a passkey held in a synced credential manager can have different recovery implications. The FIDO resource linked above explains that both synced and device-bound passkeys exist; the account provider determines the supported setup.

Protect the recovery email and the account used by your credential manager. If those are neglected, a strong sign-in method can coexist with a weak recovery route. Store recovery codes where an attacker who sees your public content cannot obtain them; never post them in a support thread or send them to someone claiming they need them to repair an account.

Finally, distinguish a sign-in request you initiated from an unexpected prompt. Stronger authentication does not make unsolicited instructions trustworthy. Use the provider’s own app or address to review an alert, and never approve a request merely to make repeated notifications stop.