A request to set up a passkey can be legitimate. It can also be a pretext for stealing access to your account. Before you follow an unexpected instruction, pause and verify it through a separate, trusted channel.
Why a passkey request deserves a closer look
In September 2026, Microsoft described a campaign in which callers or messages impersonated workplace IT support. They urged employees to update passkeys or other sign-in settings, then directed them to a lookalike sign-in site. Read Microsoft’s investigation.
The story could be plausible: some employers do ask staff to adopt passkeys. Microsoft announced changes for certain Entra ID users in its public cloud. That does not make an individual call or link trustworthy. See the scope of Microsoft’s announcement.
A real passkey is a sign-in method
A passkey lets you sign in using a device or security key. Depending on the service, you may unlock your device with a fingerprint, face scan, or PIN. Google explains that its passkeys help protect against phishing. See Google’s passkey guide.
The attack Microsoft described did not require breaking passkey cryptography. The passkey story was often a reason to send a person to a fake sign-in page or persuade them to authorize another device. A convincing request can target the setup or recovery process around an account, even when a genuine passkey is secure.
| Situation | What to do |
|---|---|
| You want to create a passkey | Start from the service or app you normally use. Follow its security settings or your employer’s verified instructions. |
| Someone unexpectedly says setup is urgent | Stop the conversation and confirm the request through a contact you found separately. |
| A prompt asks you to approve an action you did not start | Do not approve it. Ask your IT team or account provider to investigate. |
Notice the pressure and the requested action
A recognizable logo, a familiar name, or a polished message does not prove who sent it. Microsoft observed some messages sent from compromised employee accounts. The sender could appear to be someone you know. Review the observed tactics.
A device code can be part of a real sign-in flow. The problem is authorizing an action whose device and purpose you have not verified. A code or approval can give someone else access, even if the request is described as a security upgrade. The FTC explains why verification codes matter.
Verify through a separate channel
Find a trusted contact
For work, use your existing IT portal or a help-desk number from your company directory. For a personal account, open the provider’s app or a bookmarked site.
Ask about the exact request
Describe the caller, timing, requested link, and action. Ask whether a passkey change is required for your account and how the approved process starts.
Start from the verified service
If the request is genuine, follow the instructions from the trusted channel. Check the account and device named in each prompt before you approve it.
The FTC recommends avoiding links and attachments in unexpected messages and contacting the organization through a known real channel. Read the FTC guidance.
If a colleague appears to send the request, contact that person using a separate known number or company channel. Their account may be compromised. Do not assume a familiar display name settles the question.
Walk through a realistic example
Imagine that someone calls your personal phone and says they are from your employer’s help desk. They claim your account will be locked today unless you open a texted link and approve a device sign-in. This is a fictional example.
You end the call without using the link. You open the IT portal you already use and contact the listed help desk. You describe the request and ask whether the company issued it. If IT confirms a real enrollment, begin again from the portal or follow the instructions IT provides through that verified channel. If it cannot confirm the request, report the call and do not approve the prompt.
What to do if you already followed a request
You do not need to determine the full extent of the problem before asking for help. Tell your workplace security or IT team promptly if a work account is involved. For a personal account, use the provider’s official account recovery and security guidance.
Explain what happened: whether you opened the link, entered a password, shared a code, approved a sign-in, scanned a code, or gave remote access. Preserve the message and the approximate time if you can do so safely. Those details can help the team investigate.
For confirmed compromises in the campaign, Microsoft advises investigators to revoke sessions and remove unauthorized authentication methods. Employers may need to investigate cloud access as well. See Microsoft’s response guidance.
Sources and update
Checked November 2, 2026. The example is fictional. Account screens, enrollment procedures, and employer policies vary.
Frequently asked questions
Are passkeys themselves a scam?
No. Passkeys are a legitimate sign-in method. A scammer can use a passkey setup story to redirect you to a fake page or persuade you to authorize access.
Can a real employer ask me to set up a passkey?
Yes. Confirm an unexpected request with your help desk through a contact you already trust. Ask how to start the approved process.
Should I approve a sign-in prompt I did not start?
Do not approve it. Contact your IT team or account provider through a known channel and report the unexpected prompt.
What if I only opened the link?
Report it and explain exactly what you did. Tell IT or your provider whether you entered information, approved anything, or installed software. Follow its guidance for your device and account.