FAQ · Signing in
Which sign-in method is safest against phishing?
What is the difference between the methods?
| Method | Resists a fake site? | Why |
|---|---|---|
| Passkey | Yes | The browser only uses it at the service's real address. A fake site receives nothing useful |
| Phone approval with a number | Partly | It stops requests you did not make (it needs your browser's number), but a fake site relaying in real time can show you a real number |
| Six-digit code (authenticator app) | No | A fake site can ask you for the code and use it at once |
| Password alone | No | It can be copied and reused |
What do we recommend?
- Create at least two passkeys (for example on your computer and your phone), so you are not locked out if you lose one.
- Use phone approval when your passkey is not at hand.
- Keep your recovery codes somewhere safe, for emergencies.
How do I recognise a phishing attempt?
- You are asked for a code, your password or your recovery codes by phone, email or chat. Support never asks for these.
- You get a request on your phone you did not make, or with no number in the browser.
- The sign-in page's address is not your organization's usual one.
In any of these cases, decline, type nothing and tell your organization's security team.
Can the administrator require passkeys?
Yes. The access policy can require a passkey for sensitive applications or for all of them. See Policy basics.
Was this page helpful?
Thank you. Your answer stays in this browser; nothing is sent.
Sorry about that. Try:
- searching for the exact text of the message or the error code
- the error code index
- asking your organization's administrator