Passkeys Are Safer. What Happens If You Lose Your Phone?

The security improvement is real

A password can be typed into a convincing fake login page. A passkey uses a cryptographic credential bound to the real service, so a lookalike site cannot simply collect a reusable password from you. NIST classifies FIDO2 passkeys with user verification as phishing-resistant authenticators. That is a narrower, more useful claim than saying an account can never be compromised.

Your device’s PIN or biometric check unlocks use of the credential. It is not a new password you must send to every website. The practical benefit is less dependence on recognising a fraudulent login page perfectly every time. The remaining job is to keep control of the devices and accounts that make those credentials available.

First ask: synced or device-bound?

FIDO distinguishes passkeys that a provider makes available across supported devices from credentials kept on a particular device or security key. With a synced passkey, losing one phone may leave another supported device able to sign in. With a device-bound credential, losing that device can remove that particular route into the account. A second independently registered credential can therefore matter.

Do not assume that “saved on my phone” tells you which arrangement you have. Open the service’s security settings and your passkey provider’s documentation. Record which provider holds the passkey, what is required to access that provider on a replacement device, and whether the service allows an additional passkey. Compatibility and recovery steps depend on the provider and service.

A hypothetical two-phone problem

Imagine Alex stores passkeys with a provider on a phone and a laptop. The phone is lost while travelling. If the laptop still has working access to the synced credentials, Alex may retain a normal sign-in route. Now imagine the only credential was bound to the missing phone. The same headline—“phone lost”—describes a different recovery problem. This is an illustration of the distinction, not a promise about a particular provider.

The useful test happens before a device change: can you identify a working alternative without erasing, signing out of, or disabling your current route? Keep your existing session while checking the official recovery instructions. A backup that depends entirely on the same unavailable phone is not independent in this scenario.

Recovery deserves its own security check

NIST recommends multifactor protection and unique passwords where passwords remain necessary. Apply that care to the email and provider accounts involved in recovery. A strong front door is less useful if a forgotten recovery address is easy to take over. Passkeys address an authentication problem; they do not certify every message, payment request or downloaded file as safe.

1. Check the real service’s list of registered passkeys and supported backup options.
2. Keep recovery information current and store any recovery codes according to the provider’s instructions.
3. Where supported, arrange a separate recovery route, such as another registered device or security key, and keep it secure.
4. Before retiring a phone, verify access on its replacement and read the official migration instructions.

If the phone is already missing

Use a device and address you trust to reach the service’s official recovery page. Follow the phone platform’s lost-device guidance and review the account’s device and session controls. Do not disclose recovery codes to someone who contacts you offering help. If a work account is involved, use your organisation’s established support route.

The right question is not whether every passkey survives every lost device. It is whether your particular setup has a secure way back in. Spend a few minutes finding that answer while your current devices still work. For another verification habit, read our guide to AI voice-cloning scams.

Sources

• NIST — authenticator examples and phishing resistance
• FIDO Alliance — passkeys and recovery
• NIST — passwords, multifactor authentication and passkeys