Fallback Is Not a Footnote

A lost passkey turns an abstract lifecycle question into an immediate account decision. This chapter diagnoses that failure moment by separating loss reporting, ordinary alternate login, account recovery, replacement binding, and invalidation. The goal is to identify what each path is meant to prove, which normal passkey properties it preserves or loses, and when a convenient fallback has become the effective way into the account.

A lost authenticator is a compromise signal

NIST takes a deliberately conservative view of loss. An authenticator that has been lost, stolen, damaged, or subject to unauthorized duplication is treated as compromised. The reason is practical: once the legitimate subscriber no longer controls the object or its activation factor, the provider cannot safely assume that nobody else can use it. A damaged authenticator may also contain secrets that could be extracted. Treating “lost” as a harmless availability problem would leave the account accepting a credential whose control status is unknown.

The first response should therefore be containment. NIST says the credential service provider should promptly suspend, invalidate, or destroy a compromised authenticator after compromise is detected, and organizations should establish time limits for the process. Invalidation removes the binding between the authenticator and the subscriber account. Suspension can provide a temporary state while the provider investigates or waits for a legitimate subscriber to authenticate through another valid route.

That response creates a tension between security and lockout. Invalidating a legitimate authenticator by mistake can deny access, but leaving a compromised authenticator active can give an attacker durable access. NIST states that the consequences of failing to invalidate a compromised authenticator are usually more significant than the denial-of-service potential of invalidating one in error. The point is not that every report should be accepted without checking. It is that the provider should weigh the two errors honestly instead of treating continued access as the neutral default.

NIST also recommends a backup or alternate authenticator so a subscriber can securely report loss. In the specific provision for reporting loss, it describes a password or physical authenticator, with only one factor required, or an authenticated protected channel through which the provider can verify retained identity-proofing information. That provision has a narrow purpose: it gives the subscriber a way to tell the provider that a credential should be suspended or invalidated. It does not automatically authorize the same method to serve as a routine replacement for every phishing-resistant passkey login.