Security Keys for People Who Need the Strongest Protection
A physical security key is a small device that proves it is you and refuses to work on fake sites. Who benefits most, how to set one up and how to avoid getting locked out.
A security key is a small USB or tap-to-use device that you plug in or hold near your phone when you sign in. Like a passkey, it checks the website's real address before it answers, so it will not work on a phishing page even if the page looks perfect.
Who benefits most
- People who manage money for others: finance staff, treasurers, business owners.
- Administrators of email, websites, social pages or company systems. See phishing aimed at admins.
- Journalists, activists, public figures and anyone likely to be targeted personally.
- Anyone who has already been phished and wants the strongest fix.
How to set one up
- Buy two keys from a reputable seller, one to use and one as a spare.
- In your account's security settings, choose security key or passkey and follow the prompts.
- Register the spare key straight away.
- Once the keys work, review other sign-in methods and remove weak ones where you can, such as text codes.
Plan for loss. A single key with no backup is the most common way people lock themselves out. Keep the spare somewhere safe at home.
What a key does not cover
A key protects sign-in. It does not stop someone persuading you to make a payment, and it cannot help if an account still accepts a phishable fallback. For how codes get relayed, see why some two-step verification can be phished.
Received a suspicious security alert? Paste it into CyberWatch AI Scan for a free check.
For the full picture, see how to protect yourself from phishing.
Frequently asked questions
Do I need a security key if I have passkeys?
Not necessarily. Passkeys on your phone give similar phishing protection. A physical key adds a separate device, which suits people at higher risk or those who want protection that does not depend on their phone.
What happens if I lose my security key?
Register at least two keys and keep the spare somewhere safe, or keep another recovery method, so losing one does not lock you out.
Do security keys work on phones?
Many keys work with phones by USB or by tapping (NFC). Check that the key you buy supports your devices.
Sources
- Implementing phishing-resistant MFA (fact sheet), US Cybersecurity and Infrastructure Security Agency
- More than a Password, US Cybersecurity and Infrastructure Security Agency
- Multi-factor authentication for your corporate online services, UK National Cyber Security Centre
