Fake Passkey Prompts in Microsoft 365: How to Tell a Real Setup From a Phishing Trap

What is happening: attackers are borrowing the passkey

Security researchers and the technology press reported in 2026 that criminals are using the idea of a passkey as bait: a fake "set up your passkey" message that pushes Microsoft 365 users to hand over access. The attacker does not break the passkey. The attacker persuades a person to start, approve or complete a step that looks like a security upgrade but gives the attacker a way in.

On September 9, 2026, the Microsoft Security Blog published a post titled "Passkey-themed social engineering leads to identity and cloud compromise", described on the blog listing as covering passkey-themed social engineering used to compromise identities and enable broader cloud attacks. In the weeks before and after, trade and general outlets (The Hacker News, Help Net Security, International Business Times and others) ran stories about fake passkey prompts aimed at Microsoft 365 users. We could read the Microsoft listing, but not the full text of that post, so this guide does not quote its internal findings. Everything below that goes beyond the headline is either taken from Microsoft's own documentation pages we did read, or is practical advice from our technicians, and we say which is which.

Why a "security upgrade" message works so well

People have been told for years to use stronger sign-in methods. A message that says "your organization now requires a passkey" sounds like a helpful reminder from IT, not a threat. The attacker borrows three trusted ideas at once: the Microsoft name, the word "security", and a deadline. A rushed employee who has never seen a real passkey screen has nothing to compare it with, so the fake gets the benefit of the doubt.

That last point is the real lesson. If your staff have never been shown what a genuine enrollment looks like, any pretty page can pass as one. This guide gives you the comparison, plus the policy and training script to make it routine. For the basics of what a passkey is, our passkeys explained guide for business covers the foundation, and this article builds on it.

Real versus fake at a glance

The fastest test is to ask who started the process: if you did, from a page or app you opened yourself after signing in, it is probably genuine, and if a message started it for you, treat it as fake until proven otherwise. The table below compares the two experiences side by side.

Keep this table in mind as you read the next sections. The twelve detailed tells later in the article are an expanded version of it. If you only have a minute, the first row alone catches most attacks.

How a real Microsoft passkey setup works

Per Microsoft's documentation, you create a passkey either inside the Microsoft Authenticator app or from the Security info page after signing in with multifactor authentication, and a work account setup follows the policies your organization has chosen. Knowing the true path is your best defense, because every fake has to deviate from it somewhere.

We read Microsoft Learn's page on registering passkeys in Authenticator (last updated July 2026) and its page on enabling passkeys in Microsoft Entra ID (last updated June 2026). Here is what they say, in plain terms.

Path 1: inside the Authenticator app

Microsoft calls this the recommended way to set up a passkey in Authenticator. You install the app from your phone's official store, add a work or school account, sign in, tap Create a passkey, and complete multifactor authentication. If needed, you set up a screen lock and turn on Authenticator as your passkey provider in the phone's own settings (on iPhone, under AutoFill and passwords; on Android, under passwords and accounts). Microsoft lists minimum versions: iOS 17 or later, and Android 14 or later.

Path 2: from the Security info page

You open a browser, sign in with multifactor authentication to the Security info page (the address Microsoft gives is mysignins.microsoft.com/security-info, also reachable through aka.ms/mysecurityinfo), choose + Add sign-in method, and pick Passkey in Microsoft Authenticator. The page then sends you to the Authenticator app to finish. When done, you return to the browser, and the new passkey appears in the list.

Path 3: a different device or a security key

Microsoft also documents a WebAuthn route for people who cannot sign in to the app, which can involve a nearby device and Bluetooth for cross-device registration. The page notes that this route does not work if the administrator has turned on attestation. A physical security key is another supported option, and our comparison of a YubiKey versus an authenticator app explains when it fits.

What you will never be asked to do in a genuine setup

Nothing on those pages tells you to read a code from your phone aloud to someone, to scan a QR code from an email, to install a remote-control tool, or to send a screenshot of your recovery details. Microsoft's own steps are all things you do on your own devices. If a "setup" asks for any of those extras, it is outside the documented process.

A typical attack flow, step by step

The details of any single campaign vary, but social engineering attacks aimed at account sign-in generally follow the same four-stage chain: lure, capture, persist, expand. The stages below describe the general pattern, not a play-by-play from one Microsoft report, because we could only read that report's headline.

1. The lure. A message arrives that mentions passkeys or a "new security requirement". It might be an email that looks like it came from IT or HR, a text, a chat message, a shared-document notice or a pop-up on a web page. The text pushes a deadline.
2. The capture. You click and land on a page designed to look like a Microsoft sign-in. It may ask for your email, password and a code. Some versions try to relay your entries to the real Microsoft site live, so your genuine code works for the attacker too. This is why a six-digit code is not phishing-proof.
3. The persistence. Once inside, an attacker who wants to stay in will try to add something that survives a password change, such as another sign-in method, a registered device, or a mailbox rule. A "passkey enrollment" is attractive here because registering the attacker's own authenticator would make your account sign in for them in the future.
4. The expansion. With a trusted foothold, the attacker reads email, requests payments from your contacts, searches files, and looks for access to cloud apps. Microsoft's headline for the September post mentions "identity and cloud compromise", which is this stage.

The defender's job is to break the chain at the earliest point. Stage one is free for you to refuse: you do not have to respond. Stages three and four are where your administrator's settings matter, which we cover in the hardening section. Our guide to business email compromise shows what the expansion stage looks like in the real world for a small company.

Why passkey-themed bait is smart for the attacker

Most staff are still unfamiliar with passkeys, and they have heard that passkeys are "the safe thing". That makes them less alert to a request that says "do this to be safer". It also creates a cover story for a surprise sign-in prompt: "that must be the passkey thing IT mentioned". Phishing is a human problem, and this bait works on the human soft spot of trusting good news about security. For more on how modern lures are written, see our guide on AI-generated phishing emails, which explains why spelling mistakes are no longer a reliable tell.

12 tells of a fake passkey prompt versus a real enrollment

No single tell is proof, but two or more together mean stop: close the page and open Microsoft's real Security info page yourself. These twelve checks are IT Cares' practical heuristics based on how phishing generally works and on Microsoft's documented setup steps. They are not an official Microsoft list.

Tell 1: You did not ask for it

Real: you decided to add a passkey, or your IT team told you a rollout is coming and you recognize the message. Fake: a "required" setup appears out of nowhere. If you are unsure whether IT announced it, ask them by phone or in person, not by replying to the message.

Tell 2: It arrives through a side door

Real: you reach the setup through the Authenticator app or the Security info page. Fake: you reach it through an email link, text link, QR code, calendar invite, shared-file notice or chat. Any side door is a reason to go in through the front door instead.

Tell 3: The web address is not Microsoft's

Real: the address bar shows a Microsoft sign-in or account address (for example mysignins.microsoft.com for Security info, or a Microsoft sign-in page that your IT team has shown you). Fake: a long address, an extra word before or after "microsoft", a shortened link, or a document-sharing site. Zoom in on the part right before the first single slash, because that is the part that decides who owns the page. On a phone, press and hold a link to preview its address before opening it.

Tell 4: It asks for your password and codes together

Real: Microsoft asks you to prove it is you by signing in, then adds the passkey. Fake: a single page asking for your password, then a code, then a "verification" number. If a page asks you to type or read out a code in order to "activate" a passkey, back out.

Tell 5: Urgency and consequences

Real: calm, optional language. Fake: "within 24 hours", "account will be locked", "payroll will be delayed". Pressure is the attacker's main tool because it stops you from checking. Our guide on spear phishing explains why targeted lures lean on your job's deadlines.

Tell 6: A QR code replaces the link

Real: the documented cross-device flow uses a nearby device and Bluetooth, started by you on a Microsoft page. Fake: a QR code in an email, PDF or printed notice that says "scan to activate your passkey". QR codes hide the destination, which is why attackers like them, and we explain the trick in our quishing guide.

Tell 7: The sender or channel does not match

Real: an announcement from your known IT contact through the usual channel. Fake: a free mail address, a name that matches your boss but an address that does not, or a text from an unknown number. In a small office, an unfamiliar "IT helpdesk" that nobody hired is a red flag. For the SMS variant, see what is smishing.

Tell 8: It wants you to approve a sign-in you did not start

Real: when you start setup, one prompt on your own phone matches your action. Fake: a push notification that arrives while you are doing nothing, often repeated several times. Never approve a prompt you did not trigger, even if the pop-up says it is "part of passkey activation". Deny it and change your password.

Tell 9: It asks you to install something

Real: Microsoft documents installing the Authenticator app from an official app store. Fake: a download of a "security module", a browser extension, or a remote-access program. Installing the real app is fine, but only from the store listing you found yourself, not from a link in a message.

Tell 10: It asks for a recovery detail or a screenshot

Real: nothing in the documented steps asks you to send a recovery code, backup code or screenshot to anyone. Fake: "send us the code on your screen so we can finish." Those details let the attacker take over recovery. Our guide on a lost authenticator app shows how legitimate recovery is supposed to work.

Tell 11: You find an unfamiliar method afterward

Real: after setup, the Security info list shows one new passkey that you created, usually named after your device. Fake: an extra passkey, phone number or app that you never added. Check the list within minutes of any enrollment, and again if you ever suspect a trick. Microsoft's Entra page notes that details of a registered passkey can include its AAGUID, the identifier for the type of authenticator, so IT can tell whether it matches your phone or an unknown provider.

Tell 12: It discourages a second opinion

Real: it survives a phone call to IT. Fake: it warns you not to tell anyone, says IT is "unavailable", or sends follow-up messages when you pause. A process that cannot withstand five minutes of checking is not a security process.

What to do if you clicked, typed or approved something

Act in this order: stop using the suspicious page, change your password from a clean device, remove unknown sign-in methods, sign out everywhere, and tell your administrator, ideally within the hour. Speed matters more than perfection, because an attacker with a live session can add persistence quickly. The steps below are standard account-recovery practice from IT Cares technicians, matched to the Security info path Microsoft documents.

Case A: You only clicked the link or opened the page

If you landed on the page, saw it looked odd and closed it without typing anything, the risk is low. Close the tab, clear the notification if it was a pop-up, and tell IT so that others can be warned. Do not click again "to check". Run your security software if the page started a download, and do not open the file.

Case B: You typed your password or a code

1. Use a different tab or device. Open a new tab and type mysignins.microsoft.com/security-info yourself. If you can, use your phone rather than the same computer.
2. Change your password now. Pick a long, unique passphrase that you have never used elsewhere. If you reused the old password on any other site, change it there as well. A password manager makes this far easier, see our password manager guide.
3. Review sign-in methods. In Security info, delete anything you do not recognize: an extra passkey, phone number, authenticator app or email address. Keep only the ones you added.
4. Sign out everywhere. Ask your administrator to revoke your sessions, or use the sign-out-everywhere option if your account page offers it. Changing a password alone may not end a session the attacker already has.
5. Tell your administrator or IT provider. They can review sign-in logs for your account, look for unfamiliar locations or devices, and check for forwarding rules.

Case C: You approved a prompt or created a passkey

This is the serious case. Follow Case B, and in addition: remove any passkey you did not knowingly create on your own device. If you do not recognize the passkey provider listed, treat it as the attacker's. Microsoft's documentation says you can delete a passkey from the Authenticator app (Settings, then Delete passkey) and from Security info, and an administrator can delete a user's passkey from the user's Authentication methods in the Microsoft Entra admin center. Ask your admin to do it if you cannot sign in.

Check what the attacker may have touched

Whether you did Case B or C, go through these places once your account is secure:

• Mailbox rules and forwarding. Look for rules you did not create, especially those that forward, move or delete messages.
• Sent items and deleted items. Look for messages you did not send, such as payment requests or links to colleagues.
• Connected apps and consents. Remove any app you do not recognize that has access to your account.
• Files and shares. Check recently shared files and external sharing links.
• Other accounts. Anything that resets by email, such as banking, social and cloud storage, deserves a password check. Our Outlook account recovery guide and email account recovery guide go deeper.

When the attacker changed your recovery details

If you can no longer sign in because the password, email or phone was changed, do not guess repeatedly. Use Microsoft's account recovery from a trusted device, and ask your administrator to reset your authentication methods. The pattern of "recovery details quietly replaced" is common across platforms, and our walk-through of an Instagram account where the email and phone were changed shows the same logic you will use here: regain the email first, remove the intruder's methods, then secure everything else.

What your administrator should look at

For the IT person reading this: in the Microsoft Entra admin center, open the affected user and review their Authentication methods, then review sign-in and audit logs around the time of the click. Look for a newly registered method or an unfamiliar device or location, and for sign-ins that succeeded after an unusual prompt. Revoke sessions, reset the password, remove unknown methods, and review mailbox rules in Exchange. Exact log names, retention and available features depend on your licence, so we do not list a one-size-fits-all procedure here. If you want a second pair of eyes, our team can do a remote review.

Microsoft 365 admin hardening, as documented by Microsoft

Microsoft's Entra documentation lets administrators control who can register passkeys, which types and makes are allowed, and whether sensitive resources require a passkey, and these controls turn a fake enrollment from "easy" into "blocked or logged". Everything in this section comes from the Microsoft Learn page "How to enable passkeys (FIDO2) in Microsoft Entra ID" (updated June 2026) and the Authenticator registration page, both opened on October 2, 2026. Screens and names can change, so always check the live page and your licence.

1. Know that passkeys are available in every Entra edition

The page states that passkeys (FIDO2) are available in all Microsoft Entra ID editions, including Entra ID Free, with no extra licences needed. That means a small business on a basic plan can still manage passkeys. Some Conditional Access features, mentioned below, can depend on your licence, so confirm before you plan.

2. Use passkey profiles to separate groups

Passkey profiles let you apply different rules to different groups, for example administrators versus frontline staff. Per the page, a profile sets whether attestation is enforced, which passkey types are allowed (device-bound or synced), and which authenticators are allowed or blocked by their AAGUID. Up to three profiles, including the Default, are supported. The page warns that after you opt in to profiles, you cannot opt out. Microsoft's own example for high-privilege accounts is to give IT admins and executives a profile with device-bound passkeys only and attestation enforced.

3. Understand attestation and its limits

The documentation says that if attestation is not enforced, Entra cannot guarantee any attribute of a passkey, including whether it is synced or device-bound. It also says synced passkeys do not support attestation, and that enforcing attestation affects registration only: people who registered earlier without it are not blocked from signing in later. Practically, for the most sensitive accounts, device-bound passkeys with attestation give you the clearest picture of what is registered.

4. Restrict which authenticators are allowed

The key restriction setting lets you allow or block specific makes by AAGUID. The page cautions that if you remove an AAGUID you previously allowed, people who used it can no longer sign in with that method, and that AAGUID lists are a policy guide rather than a strict security control when attestation is off. Test on a pilot group first.

5. Control self-service registration

The page describes a global setting, Allow self-service set up. If it is set to No, users cannot register a passkey through Security info, even when passkeys are enabled. For a small company in the middle of a phishing wave, you may choose to centralize enrollment for a short time so that only IT-led sessions create passkeys. That is a business decision with a support cost, so weigh it.

6. Rely on the recent-MFA requirement

Microsoft states that users must have completed multifactor authentication within the past five minutes before they can register a passkey. This is a useful brake: a fake page that does not first obtain valid MFA cannot register a passkey in Microsoft's real flow. It is also a reason that fully stolen sessions are dangerous, because an attacker who relays your genuine MFA in real time can satisfy that condition. Layered controls matter.

7. Require passkeys for sensitive resources

The page explains that you can use Conditional Access authentication strength, either the built-in phishing-resistant strength or a custom one that allows only passkeys (FIDO2), so that sign-in to sensitive resources needs a passkey. It requires at least a Conditional Access Administrator role to create. Consider doing this first for administrators and finance staff.

8. Mind the Bluetooth and network requirements

For cross-device registration, the Authenticator page says both devices need internet access and Bluetooth, and that certain endpoints (for example cable.ua5v.com and cable.auth.com) must be reachable without interception. If your office blocks these, registration fails, and staff may be tempted to follow a "helpful" workaround from a fake message. Fix the legitimate path rather than leaving a gap.

9. Know how to delete an unknown passkey

The page says an administrator can delete a user's passkey in the Entra admin center by opening the user, choosing Authentication methods, and deleting the passkey entry. Practice it once before an incident.

Known issues Microsoft lists

The page notes that passkey registration is not supported for guest users, and that if a user's UPN changes, they need to delete the old passkey and add a new one in Security info. If your staff report odd enrollment errors, check these before assuming an attack.

Passkeys for non-experts: what they are and why they are still worth using

A passkey is a sign-in credential that lives on your device and is unlocked with your fingerprint, face or screen PIN, so there is no password to type, steal or reuse. It is tied to the real website, which is why a copy-cat page cannot use it. The fake prompts in this article work around that protection by tricking you, not by breaking it.

How a passkey differs from a password and a text code

• Password: a secret you know. Anyone who learns it, by phishing or a data breach, can use it.
• Text code (SMS): a code sent to your phone. Better than a password alone, but it can be intercepted, redirected or talked out of you. Press reports in September 2026 said Microsoft is retiring SMS authentication in Entra, though we did not confirm the dates on a Microsoft page, so check your own admin message center.
• Authenticator app code or push: stronger than SMS, but a fake page can relay a code in real time, and a tired user can approve a push they did not start.
• Passkey: a cryptographic key stored on your device. It is checked against the real site's identity, so a fake site gets nothing usable.

Synced or device-bound: which is for you

Microsoft's documentation describes two types. A device-bound passkey stays on one device, such as a security key or Microsoft Authenticator. A synced passkey is stored encrypted with a provider such as Apple Passwords or Google Password Manager so your other devices can use it. The page says to treat synced passkeys as phishing-resistant but with the same security posture as other unattested authenticators. For most home users and small teams, synced passkeys are the practical choice because losing a phone does not mean losing access. For administrators and finance, device-bound with attestation gives tighter control. Our passkey business guide goes through the trade-offs in more detail.

Step by step: add a passkey safely yourself

1. Update your phone. Microsoft's page lists iOS 17 or later and Android 14 or later for passkeys in Authenticator.
2. Open the app you already trust. Open Microsoft Authenticator from your phone's home screen, not from a link.
3. Add or select your work or school account and tap Create a passkey, then finish the MFA step.
4. Set a screen lock if asked and turn on Authenticator as a passkey provider in the phone's settings.
5. Confirm in Security info. Type the Security info address yourself, sign in, and make sure the new passkey is listed once.
6. Keep a backup method. Do not delete your other methods until your IT team tells you it is safe.

Common misunderstandings that scammers exploit

"Passkeys mean I never have to worry about phishing." They greatly reduce it, but the setup and recovery steps can still be attacked. "IT will text me a link to set it up." Only if your company announced it; verify first. "Biometrics are sent to Microsoft." Your fingerprint or face unlocks the key on your device; it is the device lock, not a file sent to a website. "If I lose my phone I lose everything." That is why synced passkeys, a second method and a documented recovery process matter. Our guide to a lost authenticator app covers recovery before you need it.

Keep your multifactor basics strong too

Passkeys are one layer. If you are still rolling out MFA across a company, start with our MFA guide for business owners, and make sure email, the usual target, is secure with the steps in our Microsoft 365 and Google Workspace email guide.

A one-page passkey and sign-in policy for a small business

A small business only needs about seven written rules to make fake passkey prompts far less effective, and the most important one is that nobody registers or approves a sign-in method unless they started it themselves. Copy the template below, adapt the names, and share it with every employee, including part-timers and contractors.

Rules for the person who manages IT

Whoever administers Microsoft 365 should add four duties to the policy: keep at least two accounts with admin rights and protect them with the strongest method you can manage; assign passkey rules by group as Microsoft's documentation describes; keep a written recovery procedure so that a locked-out employee is verified by a person, not by a message; and know who to call if an incident happens at 7 pm on a Friday. Our guide on business email compromise explains why the payment and invoice side of the company deserves the same attention.

Add a verification habit for money and access requests

Many account takeovers end in a request for money, gift cards, changed bank details or file access. Add a rule: any request that changes how money moves or who can access what is confirmed by a second channel, such as a phone call to a known number, regardless of who appears to have sent it.

A 15-minute staff training script

The most effective training is short, concrete and repeated: show the real screens, show a fake, and let people practise saying "I will check first". Use the script below in a team meeting, adjusting names and tools. It needs no technical background.

Minute 0 to 3: the story

Say: "Attackers are sending fake messages that say we need to set up a passkey. They know people want to be secure and they know we are busy. The message is designed to make us click before we think. Today we will learn how to spot it in ten seconds."

Minute 3 to 7: show the real thing

Open the Security info page live on a shared screen (typing the address, not clicking a link). Show the list of sign-in methods and where a passkey would appear. Open Authenticator and show where Create a passkey lives. Say: "A real setup happens here, because we opened it ourselves."

Minute 7 to 11: show three fakes

Show three mock messages (draw them on a slide, do not use a live phishing page): one with an urgent HR deadline, one with a QR code, one from a "helpdesk" you do not have. Ask the team to point at the tells from the twelve-tell list earlier. Our guides on what phishing is and quishing give additional examples to borrow.

Minute 11 to 14: practise the response

Teach one sentence staff can say without embarrassment: "I will check this with IT first." Have everyone say it aloud. Show how to report: forward the message as an attachment or screenshot to [IT contact], and then delete it. Remind them that if they clicked, they should report straight away, because speed limits the damage.

Minute 14 to 15: the three rules

• If I did not start it, I do not approve it.
• If it is rushing me, it is probably wrong.
• If I am unsure, I stop and ask.

Repeat the exercise every quarter with a new example. Lectures fade; repetition builds a habit. If you would like a trainer to run this session for your team, IT Cares can deliver it remotely.

Three realistic scenarios (illustrative)

These scenarios are invented illustrations to show how the checks work in practice, not real cases or real clients. Names and numbers are made up.

Scenario 1: The urgent email at 4:50 pm (illustrative)

A bookkeeper at a 9-person company gets an email that says everyone must set up a passkey by 5 pm or lose access to payroll. It has a button. She remembers the training, does not click, and instead types the Security info address into a new tab. Nothing is waiting for her there. She calls her IT provider, who confirms there is no rollout. Time spent: four minutes. Loss: none. The rule that saved her was Tell 1: she had not asked for it.

Scenario 2: The employee who entered a code (illustrative)

A sales rep clicks a link in a chat message, signs in on a page that looks right, and enters a code. A few minutes later he realizes the message did not come from a colleague. He follows Case B in this guide: new password from a clean phone, Security info review, an unknown phone number removed, sessions revoked by IT, and a mailbox-rules check that finds a forwarding rule. Total time to contain: about 50 minutes. Because he reported at once, no invoices were altered. Had he waited a day, the story could have ended differently.

Scenario 3: The unexpected passkey in the list (illustrative)

During a quarterly review, an office manager sees a passkey named after a device she has never owned. She deletes it, changes her password, tells IT, and learns from the sign-in logs that an unfamiliar location had signed in two weeks earlier. IT reviews mailbox rules, finds nothing, and tightens the policy so that new passkey registration needs an IT-led session for the next month. The quarterly review habit was the control that worked.

What it costs in CAD: do it yourself or get help

Most of this is free: reviewing sign-in methods, changing a password and running a training session cost only time, while a professional review is worth paying for when money, client data or admin accounts may be exposed. The figures below are rough planning numbers, not quotes.

A single IT Cares Expert Consultation is 119.99$ CAD for 60 minutes, which is enough to review one account, clean up sign-in methods and write a short policy. Compare that to the cost of a fraudulent invoice, a day of lost work, or a privacy notification obligation after a breach, and the check is cheap.

Official resources

For authoritative steps, use Microsoft's own documentation and your national fraud-reporting body rather than blogs or messages.

• Microsoft Learn: Register passkeys in Authenticator on Android and iOS
• Microsoft Learn: Enable passkeys (FIDO2) in Microsoft Entra ID
• Microsoft Security Blog (look for the September 9, 2026 post on passkey-themed social engineering)
• Canadian Anti-Fraud Centre, to report fraud in Canada.
• Canadian Centre for Cyber Security, for guidance for individuals and small organizations.

When to call a professional

Call a professional if you approved a prompt, entered credentials into an unfamiliar page, found a sign-in method you did not add, or you manage an account that handles payments or client data. Those are the cases where hidden persistence, such as forwarding rules or extra devices, is most likely and most costly.

IT Cares has provided remote and on-site IT support in Quebec and across Canada since 2014. We can review your sign-in methods, help recover an account, tighten Microsoft 365 settings and train your staff, remotely and while you watch. Call 1 (888) 711-9428 or book a session. A 60 minute Expert Consultation is 119.99$ CAD.

Frequently asked questions

Related guides

• Passkeys explained: passwordless login for business
• What is phishing and how to spot it
• AI-generated phishing emails: how to spot them
• What is smishing (SMS phishing)
• Quishing: QR code phishing explained
• Spear phishing: protect employees at a small business
• MFA guide for business owners
• Microsoft Outlook account hacked: recovery
• Email account hacked: recovery
• Secure business email on Microsoft 365 and Google Workspace
• Business email compromise: protect your small business
• Lost authenticator app: recover 2FA access
• YubiKey vs authenticator app
• Instagram hacked, email and phone changed: recovery

Sources and official references

Last verified: October 1, 2026

• Microsoft Security Blog, 9 Sept 2026: listing for "Passkey-themed social engineering leads to identity and cloud compromise" (headline and summary only; article body not read)
• Microsoft Learn: Register passkeys in Authenticator on Android and iOS devices
• Microsoft Learn: How to enable passkeys (FIDO2) in Microsoft Entra ID
• Microsoft Security Blog index (checked 2 Oct 2026)