What Is a Passkey? Meaning, How It Works and How to Protect Your Business

Key Takeaways

1. The risk to your company: staff who log in with a password and SMS code can be phished in real time. A passkey cannot be typed into a fake site, so attackers turn to account recovery, fallbacks and people.
2. A passkey is a login credential stored on your phone, computer or security key and unlocked with your face, fingerprint or PIN. There is no password to steal.
3. It only works on the genuine website, which makes it phishing-resistant in a way SMS and app codes are not.
4. The SFC's circular 26EC35 requires Hong Kong internet brokers and virtual asset platforms to stop using one-time passwords for client login by 8 July 2027.
5. Turn passkeys on for email, WhatsApp and admin accounts first, then remove the weak fallbacks.

If a fake bank page can collect your password and your SMS code in one go, the code was never really protecting you. Passkeys were built to close exactly that gap, and Hong Kong regulators have started to insist on them.

What is a passkey?

A passkey is a login credential that replaces your password. It is a pair of digital keys: a private key that stays on your phone, computer or hardware security key, and a public key held by the website. You unlock it with your face, fingerprint or screen PIN, so there is nothing to type, remember or hand over.

Think of a password as the door code to your building: anyone who overhears it can walk in. A passkey is closer to a resident's access card that only opens your own building's door, and only while it is in your hand.

Passkeys are built on FIDO2 and WebAuthn, open login standards from the FIDO Alliance (Fast IDentity Online, an industry body). Apple, Google, Microsoft and WhatsApp accounts all support them.

How does a passkey work?

When you create a passkey, your device makes a key pair and sends only the public key to the website. At each login the site sends a one-time challenge; your device signs it after you unlock with face, fingerprint or PIN. The signature is tied to the real web address, so a fake site gets nothing usable.

A Hong Kong example: an accounts clerk at a Kwun Tong trading firm receives an SMS saying her brokerage account is locked, with a link to a perfect copy of the login page. With a password and SMS code, she types both and the attacker relays them to the real site within seconds. This real-time relay is the pattern the Securities and Futures Commission (SFC) described when it issued circular 26EC35 in July 2026. With a passkey, her phone sees that the address does not match, finds no passkey for it and offers nothing to sign.

The four steps behind every passkey login

1. Create: your device generates the key pair and stores the private key in iCloud Keychain, Google Password Manager, another passkey manager, or on a security key.
2. Challenge: when you log in, the website sends a random one-time challenge.
3. Unlock: you confirm with face, fingerprint or PIN. Your biometric data never leaves the device.
4. Sign: the device signs the challenge for that exact domain, and the website checks the signature with the public key it already holds.

What types of passkeys are there?

There are three common types. Synced passkeys are stored in Apple, Google or Microsoft accounts and follow you to new devices. Device-bound passkeys stay on one phone or computer. Hardware security keys are small USB or NFC tokens. Synced passkeys are easiest; device-bound and hardware keys give stricter control for admin accounts.

Type	Where it lives	Best for	Watch out for
Synced passkey	Apple, Google or Microsoft account	Most staff and personal accounts	Only as safe as the cloud account behind it
Device-bound passkey	One phone or computer	Systems that need tight control	Losing the device without a backup
Hardware security key	USB or NFC key	Admins, finance approvers	Extra cost; issue two per person

How do attackers get around passkeys?

Attackers rarely break the passkey itself. They go around it: forcing a fallback to password or SMS code, abusing account recovery, taking over the Apple or Google account that syncs your passkeys, stealing a logged-in session with malware, or persuading a person to approve something. Watch for any request to 'use another way' to sign in.

The main routes in

1. Fallback downgrade: a fake page says the passkey is 'unavailable' and asks for your password and SMS code instead.
2. Recovery abuse: the attacker calls your IT help desk pretending to be staff, or uses an SMS reset, then registers their own passkey.
3. Sync account takeover: phishing your Apple ID or Google account gives access to every passkey synced to it.
4. Device-code phishing: you are guided to type a code into a genuine Microsoft sign-in page, which quietly authorises the attacker. HKCERT's Q3 2026 report notes that the EvilTokens kit was linked to more than 12,000 inboxes within months of launch (HKCERT, 5 Nov 2026).
5. Session theft: information-stealing malware copies browser cookies after you have logged in, so no login is needed.
6. Linked devices and QR codes: for example, scanning a WhatsApp Web QR code that links the attacker's computer; see What Is WhatsApp Hijacking?.

Warning signs

1. An email or alert saying a new passkey or device was added, when you did nothing.
2. A login page whose address you did not type or bookmark yourself.
3. Anyone asking you to read out a code or tap 'Approve'.

How do you protect accounts with passkeys?

Start with the accounts that unlock everything else: email, Apple or Google account, WhatsApp, banking and admin consoles. Create a passkey on each, keep a second passkey or security key as backup, then switch off SMS codes or passwords as a fallback where the service allows. Companies should also write a verification rule for payments.

For individuals: exact settings (last checked 10 November 2026)

1. WhatsApp on iPhone: WhatsApp > Settings > Account > Passkeys > Create passkey (iOS 16 or later; saved to iCloud Keychain).
2. WhatsApp on Android: WhatsApp > Settings > Account > Passkeys > Create passkey (Android 9 or later with Google Password Manager or another passkey manager).
3. Google account on iPhone or Android: open myaccount.google.com > Security > How you sign in to Google > Passkeys and security keys > Create a passkey.
4. Apple Account on iPhone: passkeys save automatically to iCloud Keychain; review them in the Passwords app (iOS 18 or later) or Settings > Passwords.
5. Microsoft account: account.microsoft.com > Security > Manage how I sign in > Add a new way to sign in > Face, fingerprint, PIN or security key.

Menu names can differ slightly by phone maker and app version.

For SMEs and IT teams

1. Turn on phishing-resistant multi-factor authentication (MFA) for Microsoft 365 or Google Workspace admin accounts first, then roll it out to all staff.
2. Remove SMS fallback for admins and issue each one two hardware security keys.
3. Lock down recovery: the help desk resets a login only after calling the person back on the directory number, and every new passkey triggers an alert.
4. If you run a client portal or app, test login, device binding and account recovery as one flow. The weak point is usually in the last two.

Company scenario: when the passkey cannot be phished

Once staff logins are protected, criminals target the payment process instead. A common script: the 'director' messages the accounts team on WhatsApp from a new number, says he is in a meeting, and asks for an urgent supplier payment or for the verification code that has just arrived. Nobody is logging in, so no passkey can stop this. What stops it is a rule.

Company rule: no payment, change of bank details or sharing of a code on a message alone. Call the requester back on the number already in the company directory, and have a second person approve any new payee.

Staff notice (copy into your WhatsApp group)

[IT notice] We are moving to passkey logins.
1. This week, create a passkey for your work email and WhatsApp (steps from IT).
2. Never type your password or a code into a link from SMS, WhatsApp or email.
3. IT will never ask you to read out a code or approve a sign-in you did not start.
4. Any payment request by message: call the person back on the directory number first.

What should you do if an account with a passkey is compromised?

Act within minutes. Sign out all sessions, delete any passkey or linked device you do not recognise, change the password and recovery details of the email or Apple or Google account behind it, and warn contacts. Then call the Anti-Scam Helpline 18222 if money is involved, and report to HKCERT.

1. Anti-Scam Helpline 18222, run 24 hours by the police Anti-Deception Coordination Centre, gives immediate advice. To file a formal report, go to a police station or the police e-Report Centre; call 999 in an emergency.
2. Check suspicious numbers, accounts and links on Scameter.
3. Call the HKCERT hotline on 8105 6060 or use its incident report form.
4. If cards or payments are involved, call your bank immediately to freeze them.
5. If customer or staff personal data may have leaked, consider notifying the Privacy Commissioner for Personal Data and the people affected.
6. Keep evidence: screenshots, sender numbers and times.

Passkey vs OTP vs password: what is the difference?

A password is a secret you know, and an OTP is a short code sent or generated for you; both can be typed into a fake site and relayed. A passkey is a cryptographic key on your device that signs in only on the genuine site, so it resists phishing and leaves nothing for a database breach to leak.

	Password	SMS or app OTP	Passkey
Works on a fake site?	Yes	Yes, relayed in real time	No, tied to the real domain
Leaked in a website breach?	Yes, if poorly stored	Not reusable	No, the site holds only a public key
What you do	Type it	Type a code	Face, fingerprint or PIN
Weak point	Reuse and guessing	Relay, SIM swap	Recovery and the sync account

A passkey already combines two factors, something you have (the device) and something you are or know (biometric or PIN), so it counts as a phishing-resistant form of MFA. For the attack it is designed to stop, see What Is Phishing?.

Do Hong Kong businesses have to use passkeys?

Most do not, yet. The clearest rule is the SFC's circular 26EC35 of 9 July 2026, which tells licensed internet brokers and virtual asset trading platforms to stop using one-time passwords for client login and device binding by 8 July 2027. HKCERT now recommends phishing-resistant MFA for high-risk accounts.

Hong Kong latest (updated November 2026)

1. HKCERT recorded 4,404 security incidents in Q3 2026, about 15% more than a year earlier. Phishing made up 2,672 cases, about 61%, and social media and messaging apps were the target in about 46% of phishing cases (HKCERT, 5 Nov 2026).
2. In mid-September 2026 the police received more than 700 reports of suspected credit card misuse within a short period, with losses of about HK$14.7 million (HKCERT alert, 14 Sep 2026).
3. Globally, the FIDO Alliance's Passkey Index (October 2026) found that 36% of successful sign-ins across 12 participating services used a passkey, up from 26%, and all 8 services that measure it reported fewer successful phishing attacks (FIDO Alliance). These are global, not Hong Kong, figures.

Should your company switch to passkeys now?

Yes, starting with the accounts that matter most. A passkey removes the one secret that phishing pages are built to steal. It does not remove the need for tight recovery controls, no weak fallbacks and a payment call-back rule, because that is where attackers go next.

60-second self-check

1. Does your main email and every admin account have a passkey or security key?
2. Is SMS still allowed as a fallback for admin accounts?
3. Who can reset a staff login, and how do they confirm it is really that person?
4. Does every payment request sent by message get a call-back?
5. Would you get an alert if a new passkey or device were added?

Test your login flows before attackers do

A passkey is only as strong as the fallback and recovery flows around it. A penetration test checks login, device binding and account recovery on your website, app or client portal the way a real attacker would, then retests the fixes.

Book a Free Assessment

Frequently Asked Questions

Can a passkey be stolen?

The private key is designed never to leave your device or passkey manager, and the website stores only a public key. The realistic risks are someone unlocking your phone, or taking over the Apple, Google or Microsoft account that syncs your passkeys.

What happens if I lose my phone?

Synced passkeys come back when you sign in to your Apple or Google account on a new device. Device-bound passkeys do not, so register a second device or a hardware security key as a backup before you need it.

Do passkeys cost anything for a small business?

Passkeys are free in Apple, Google, Microsoft and WhatsApp accounts. Hardware security keys are an optional purchase, usually worth it for administrator and finance approver accounts.

Does the SFC rule apply if my company is not a broker?

No. Circular 26EC35 covers SFC-licensed internet brokers and virtual asset trading platforms. Other companies are not bound by it, but HKCERT recommends phishing-resistant MFA for high-risk accounts.