FIDO2 Account Recovery Emerges as Weak Point in Passwordless Rollouts

Hardware-bound FIDO2 authenticators resist phishing, but their design makes account recovery difficult when a user loses the device. Organisations adopting passkeys typically build a recovery path, and that path is often weaker than the password it replaced. Documented attacks on MFA deployments tend to bypass the cryptographic factor entirely, instead persuading support staff to reset credentials using victims' personal details. The article recommends treating recovery as a strict authentication process, verifying backup authenticators at enrolment, notifying owners through independent channels, and failing closed when verification is incomplete. It also notes that no widely adopted standard yet matches the assurance of the FIDO2 login process, so residual risk remains.