The Phone Is the Credential: Mobile Security After Passwords

The most-quoted statistic about passwordless adoption is also the most wrong. It is not true that more than seventy percent of major enterprises have left passwords behind. FIDO's May 2026 survey found 68% of organisations have deployed passkeys or are actively deploying them, but only 28% are fully passwordless, and the Passkey Index published in October 2026 puts passkey sign-ins at 36% of successful authentications. Real progress, still a minority, and a useful corrective to the assumption that the hard part is over.

What has genuinely changed is where authentication lives. A passkey is not a password that happens to be long. It is a key pair, and in the consumer and enterprise default it is held by the platform account that syncs it: iCloud Keychain, Google Password Manager, a password manager, or in the higher-assurance case a hardware device. That is a large improvement against phishing, because there is no secret to type into a proxy page. It also means the phone, and the account that backs it up, now sit at the centre of your identity perimeter.

Synced and Device-Bound Are Different Products

A synced passkey survives the loss of a handset, which is why employees like it, and it inherits the security of the cloud account holding it, which is why administrators should care. A device-bound passkey cannot be copied off the device, which raises assurance and creates a recovery problem the moment the device is lost or replaced. Most organisations deploy the synced kind for general staff and the device-bound or hardware kind for administrators, and then fail to document which is which. Inventory the authenticators you accept, including their attestation identifiers, or you cannot answer the question an auditor will ask after an incident: which credentials were phishing-resistant, and where were they stored?

SIM Swap Is Still the Soft Way In

Port-out fraud remains the cheapest route around SMS-based second factors, and it does not require compromising the carrier's network. It requires a convincing call to a retail store or support line with enough personal detail to pass verification, which is exactly the data that leaks in the average breach. Carrier port-out locks and account PINs help, and regulators in several markets now require them, but they are a speed bump rather than a control. High-value accounts, and every administrator account, should not be recoverable by SMS at all. Where a phone number is still used as an identifier, treat it as a username rather than a secret.

Smishing Moved to the Camera

The phone is also the delivery mechanism. SMS and messaging-app phishing has the advantage of arriving in the place people trust most, and QR codes moved the victim's browser off the corporate device and onto the personal one, where there is no proxy, no managed browser and no URL preview worth reading. The adversary-in-the-middle kits that made phishing resistant to ordinary URL inspection work less well on a small screen, which is precisely why the QR code exists.

On the authentication side, push-notification fatigue remains effective against organisations that still allow a simple approve button. Number matching, additional context in the prompt, and rate limiting on prompts are not exotic controls; they are the difference between a failed login and a successful one. Where the identity provider supports it, bind the authentication to the application and the location so a stolen session token is worth less.

The Device Itself

Mobile malware rarely needs an exploit. On Android, accessibility-service abuse and sideloaded applications still deliver banking trojans and screen-capture tooling, and the user grants the permissions themselves. On iOS the bar is higher, but enterprise sideloading, configuration profiles and mobile device management enrolment are all attack surface in their own right. Practical controls are unglamorous: keep the operating system current, require Play Integrity or App Attest signals for sensitive applications, block installation from unknown sources on managed devices, and put high-risk staff on Lockdown Mode.

Managed and Personal Devices Need Different Answers

The BYOD argument is usually framed as a choice between control and privacy, and it is better framed as a choice of scope. On a personal phone, the organisation should control the container, not the device: managed applications, per-app VPN, selective wipe, and a clear statement that the company cannot see personal photos or messages. On a corporate device, full management and compliance attestation are reasonable. What does not work is treating an unmanaged device as equivalent to a managed one because the user installed an authenticator app. Conditional access should grant browser-only, session-limited access from devices it cannot attest, and full access from devices it can.

• Count what you have: percentage of sign-ins that are phishing-resistant, not percentage of users who enrolled once.
• Protect recovery: the helpdesk reset is now the weakest link in a passkey deployment.
• Remove SMS from the privileged path: administrators first, then finance and executives.
• Assume the personal phone is hostile: container it, do not trust it.

Passwordless is not a finish line that a project crosses. It is a shift of risk onto devices, platform accounts and recovery processes, all of which need the same attention the password database used to get.