That Passkey IT Call Is a Scam (2026)

A cold call that says IT needs you to update your passkey or biometric is how attackers steal the account — not how they fix it. Microsoft Security Research published on September 9, 2026 on passkey-themed social engineering leading to identity and cloud compromise, tracked since May 2026. The passkey story is usually a pretext for adversary-in-the-middle phishing or device-code flows that capture session tokens, then persistence by registering an attacker-controlled MFA method. This Digital Identity long-form covers the lure on personal phones and Teams, what they steal, how to refuse, and safer passkey habits: real IT never cold-enrolls you on a live call, hang up, verify on a known-good channel, never enter their device codes, audit who can add authenticators, approve device adds carefully, prefer hardware keys on high-value accounts, and point to recovery planning without a full lose-device recap. Passkeys Jul 17:    • Passkeys 2026: Apple vs Google vs Microsof...   2FA ranking:    • 2FA Ranked: SMS vs Authenticator vs Hardwa...   Passkey recovery:    • Advanced Passkey Management & Recovery in ...   Practical, privacy-first identity guidance from 30-plus years in IT.