← Articles and guides on fraud, cybersecurity, privacy and AML

Passkeys, MFA and the end of passwords: what stops account takeover

97% of identity attacks rely on passwords. Which MFA methods resist phishing, what passkey data show and a practical checklist to stop account takeover.

2026-10-03

Passwords remain the weakest link. Microsoft's Digital Defense Report 2025 says identity attacks rose 32% in the first half of 2025 and 97% were password spray or brute force (Expert Insights). Verizon's 2025 DBIR found stolen credentials were the top breach vector at 22% (Help Net Security).

Account takeover is the gateway to many other crimes: bank fraud, scams run from a victim's social media profile, business email compromise and network intrusions that end in ransomware. A single reused password can open all of those doors.

Not all MFA is equal

Microsoft says modern MFA blocks more than 99% of unauthorised access attempts. But attackers have learned to bypass weaker forms. CISA's guidance, summarised by Bricker Graydon, ranks them:

Method	CISA view	Main threats
FIDO/WebAuthn (passkeys, security keys) and PKI	Phishing-resistant	Low exposure
App OTP or push	Vulnerable	Real-time phishing, push bombing
SMS, voice, email	Last resort	SIM swap, SS7 flaws

Where push remains, CISA recommends number matching and a phased migration starting with email, file servers, remote access and high-value users.

Passkeys

Passkeys are FIDO credentials bound cryptographically to the legitimate site, so there is nothing to hand over on a fake page. FIDO's first Passkey Index (14 October 2025), with data from Amazon, Google, Microsoft, PayPal, Target, TikTok and others, found 93% of accounts eligible, 36% enrolled, 26% of sign-ins using passkeys, a 93% success rate versus 63% for other methods, 8.5-second logins versus 31.2 seconds and an 81% drop in login help-desk incidents (FIDO Alliance).

The 2026 Index (15 October) reports 36% of successful sign-ins now use a passkey, with 93% success against 78% for traditional MFA; every participant measuring phishing saw fewer successful attacks, and every participant reporting cost data saw lower SMS one-time-password spending (FIDO Alliance). Usage is growing faster than enrolment, a sign that people who set up a passkey keep using it.

NIST's password rules

The final NIST SP 800-63B, reviewed by Intercede, drops forced periodic changes and composition rules, supports passphrases of at least 15 characters, requires screening against breached-password lists and clarifies the use of syncable authenticators such as passkeys at AAL2 and AAL3.

Synced or device-bound?

Synced passkeys live in platform credential managers and move across a user's devices, which suits most consumers. Device-bound passkeys, such as hardware security keys, never leave the device and are preferable for administrators and very high-value accounts. Either is far stronger than a password plus SMS code.

Remaining gaps

Session-token and machine-credential theft bypass login altogether. The 2025 Shai-Hulud npm worm hunted GitHub tokens and cloud keys; CISA urged credential rotation and phishing-resistant MFA for developers (CISA). Weak account recovery can also undo a strong login.

Checklist

Turn on passkeys or FIDO keys for email, banking and cloud.
Start with admins, remote access and finance teams.
Enable number matching if you keep push.
Retire SMS where alternatives exist.
Harden account recovery.
Monitor and expire session and API tokens.
Block passwords found in breach lists.