Because recovery often falls back to the weakest available channel, such as email, SMS, or support-driven identity checks. An attacker who can compromise or social-engineer that path can regain access and register their own passkey. In practice, the downgrade path becomes the point of failure, not the passkey cryptography.
How recovery becomes the real weak point
Passkeys are strong when the authenticator and relying party stay in the normal WebAuthn flow, but recovery is a different trust problem. The moment a user loses a device, the organisation has to decide how to re-establish trust, and that often means using an older channel with weaker assurance, more social engineering exposure, or more operational exceptions than the passkey itself.
That is why the risk sits in the recovery design, not in the cryptography. A good passkey implementation can still be undermined if the recovery path lets an attacker substitute email control, SMS possession, support desk persuasion, or an easily reset factor for genuine account recovery.
Why downgrade paths are structurally weaker
Recovery flows usually exist to handle edge cases, which means they are harder to standardise and easier to special-case. If the user cannot present the original authenticator, the system must rely on a fallback signal, and that signal is often less phishing-resistant, less device-bound, or less tightly verified than the passkey.
That downgrade is not accidental. Organisations tend to optimise recovery for usability and support volume, then discover that the path designed to help legitimate users is also the path an attacker will target after passwordless sign-in removes easier entry points. The weaker the fallback, the more the attacker can bypass the passkey entirely and attack the recovery gate instead.
For a broader control view, NIST’s digital identity guidance is useful because it separates authentication strength from recovery assurance and makes clear that recovery must be treated as part of the identity lifecycle, not as a convenience add-on. NIST SP 800-63 Digital Identity Guidelines is especially relevant where passkeys are being used as the primary authenticator but not the only trust anchor.
What attackers exploit in recovery
The common failure mode is not breaking the passkey. It is taking over the account through the alternate channel and then enrolling a new passkey under attacker control. If the help desk can be convinced, if email is compromised, or if SMS is redirected, the attacker can reset access and make the stolen session or recovery step look legitimate.
That same pattern shows up in account-recovery abuse and support social engineering, which is why recovery hardening matters as much as authenticating the user at login. NHIMG’s Account Recovery and Help Desk Security Guide focuses on caller verification, MFA reset controls and monitoring, while the Passwordless and Passkeys Guide covers the practical gap between strong passkey sign-in and weaker recovery paths.
Recovery abuse is also one reason passkey rollouts fail to reduce account-takeover risk as much as expected. If the organisation keeps SMS, email reset links, or support exceptions as routine recovery options, the attacker only has to target the least resistant option. The passkey remains strong, but the account boundary has moved to the fallback.
What strong recovery looks like in practice
Good recovery design narrows the set of acceptable fallback signals and makes them more observable. The best patterns use high-assurance reproofing, step-up checks, recovery delay windows, explicit notification to existing devices, and tight controls on who can approve enrollment of a new authenticator. NHIMG’s Workforce Identity Security Guide and Identity Provider and SSO Security Guide are useful when recovery is tied to help-desk operations, federation, or session security.
Recovery should also be measured as an attack surface of its own. If users regularly depend on support-driven resets, if too many accounts can be recovered through email alone, or if recovery events are not logged and reviewed, the organisation has not solved passwordless risk, it has moved it. A passkey programme is only as strong as the controls that govern re-enrollment after loss of the original device.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Passkey assurance and recovery assurance are central to digital identity proofing and authenticators. |
| Recommendation — Apply digital identity assurance guidance to keep recovery from weakening passkey strength. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Recovery depends on secure lifecycle handling of authenticators and replacement credentials. |
| IA-2 — Identification and Authentication (Organizational Users) | Recovery flows still re-establish user identity before access can be restored. | |
| Recommendation — Manage authenticator lifecycle so recovery cannot silently replace a strong factor with a weaker one. Require strong user re-authentication before allowing account recovery or new passkey enrollment. | ||
| OWASP ASVS | V6 — Authentication | Recovery is part of the authentication assurance boundary when a new factor is enrolled. |
| Recommendation — Verify that account recovery cannot bypass the authentication strength of the primary sign-in method. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Recovery changes access and should be governed as a controlled access event. |
| Recommendation — Restrict recovery privileges and review recovery-driven access changes as access-control events. | ||
Practitioner Guidance
What to verify: Treat every recovery path as a privileged control. Verify whether it can be completed without the original passkey, whether it permits immediate re-enrollment, and whether the user receives a tamper-evident alert when recovery is triggered.
Decision rule: If a recovery method can be used by an attacker after compromising email, SMS, or the help desk, do not count it as equivalent to passkey assurance. Treat it as a downgrade path and apply compensating controls before relying on it for high-value accounts.
What practitioners underestimate: The issue is rarely “can the passkey be phished?” It is “how many alternate ways exist to replace the passkey once the original is lost?” That is the question that determines real account-takeover exposure.
Practitioner takeaway: A passkey can be cryptographically strong and still sit behind a fragile recovery process, so the right security question is not how users sign in, but how they prove they deserve a new sign-in path after the old one is gone.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 11, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org