Why do passwordless logins still leave organisations exposed to impersonation risk?

Passwordless reduces password friction, but it does not automatically prove the user’s identity. If a token, device, or session is compromised, an attacker can still operate behind a legitimate login. Organisations need assurance that the authenticated user is the same verified individual, especially for high-value applications and customer journeys.

Why This Matters for Security Teams

Passwordless removes one of the most abused attack paths, but it does not, by itself, stop impersonation. The risk shifts from guessing a password to abusing a trusted token, device, or session. That matters because authenticated access can still be hijacked after a legitimate login, especially in high-value customer journeys, admin workflows, and recovery flows. NIST Cybersecurity Framework 2.0 is explicit that identity assurance and access control are separate concerns, and both must be managed deliberately.

NHIMG research shows the same pattern across identity security more broadly: in the Ultimate Guide to NHIs — Why NHI Security Matters Now, 80% of identity breaches involved compromised non-human identities such as service accounts and API keys. The lesson transfers cleanly to passwordless environments. If the underlying session, device binding, or recovery path is weak, the login method becomes less relevant than the attacker’s ability to act as the authenticated party. In practice, many security teams discover impersonation only after account takeover, not through intentional assurance testing.

How It Works in Practice

Passwordless authentication usually proves possession of a device, authenticator, or private key, not the full real-world identity behind the request. That distinction is acceptable for many low-risk flows, but it becomes dangerous when organisations assume the login ceremony itself is evidence of impersonation resistance. Stronger assurance requires layered controls that validate who is operating the session, not just what factor unlocked it.

Current guidance suggests combining passwordless with identity proofing, device trust, step-up checks, and session protections. For example, a FIDO2 passkey may reduce phishing risk, but if the endpoint is compromised or the session token is stolen, the attacker can still continue as the legitimate user. This is why many organisations pair passwordless with continuous risk evaluation, transaction signing for high-risk actions, and re-authentication for account recovery or payment changes. The NIST Cybersecurity Framework 2.0 supports this layered approach by treating identity assurance, access enforcement, and monitoring as connected functions rather than a single gate.

NHI governance reinforces the same point. The Top 10 NHI Issues and the 52 NHI Breaches Analysis both show that trusted identities fail when secrets, tokens, or lifecycle controls are weak. For passwordless users, the analogue is the authentication session itself: if it is long-lived, poorly bound to device context, or easy to recover through weak help-desk procedures, impersonation remains possible even without a password. These controls tend to break down in high-volume consumer support environments because recovery workflows are optimised for speed, not identity assurance.

Common Variations and Edge Cases

Tighter verification often increases user friction and support cost, so organisations have to balance impersonation resistance against abandonment and operational overhead. That tradeoff becomes most visible in account recovery, delegated access, and regulated transactions.

Best practice is evolving, and there is no universal standard for this yet. For low-risk consumer actions, passwordless plus device binding may be sufficient. For financial transfers, admin access, healthcare records, or support resets, additional proof should be required, such as step-up authentication, verified-device checks, signed transaction approval, or out-of-band confirmation using a previously established channel. Organisations should also harden recovery paths, because attackers often bypass the primary login entirely and target the weakest exception flow.

The key mistake is treating passwordless as an identity guarantee instead of an authentication method. The more valuable the action, the more the organisation should ask whether the same person is still in control of the session. The Anthropic report on AI-orchestrated cyber espionage is a useful reminder that adversaries increasingly automate credential and session abuse, which raises the stakes for recovery design and continuous verification. This guidance breaks down in call-centre-heavy environments with weak caller verification, because attackers can socially engineer support staff into resetting an already trusted login.

Related resources from NHI Mgmt Group

• Why do partial passwordless deployments still leave organisations exposed?
• Why do MFA deployments still leave organisations exposed to identity risk?
• Why do network security tools still leave organisations exposed to access risk?
• Why do strong IAM controls still leave organisations exposed to audit and fraud risk?