Passwordless authentication is sold as the cure for phishing and credential theft. It removes stored passwords, replacing them with biometrics, cryptographic keys, or single-use tokens. Hardened authentication flows make brute-force attacks pointless. Yet social engineering remains the sharp edge.
Social engineering bypasses code and protocols by targeting humans. Attackers trick users into approving prompts, revealing recovery codes, or granting device access. Even in passwordless systems, human error can open the same door a password once did. Phishing pages can imitate passkey prompts. Fraudulent support calls can convince staff to reset authenticators. A fake “device enrollment” request can slip past security reviews if policy and training lag behind the tech.
Defense requires layering. Passwordless authentication should run alongside strict user verification practices. Implement step-up authentication for sensitive actions. Restrict recovery flows to separate, hardened channels. Use binding between cryptographic credentials and physical devices to block token replay. Monitor for abnormal enrollment activity and prompt for additional checks when behavior deviates from baseline.