# Plan Account Recovery Before Rolling Out Passkeys A successful sign\-in demo leaves one important question unanswered: who gets back in when the enrolled device disappears? ![A security key and a sealed recovery envelope on a desk\.]() A fallback credential is part of the account’s security boundary\. A passkey rollout usually starts with a successful sign\-in demonstration\. The harder test starts when the user's only enrolled device is gone\. If support can bypass the stronger sign\-in method after a weak identity check, the recovery route becomes the route an attacker will choose\. ## Identify what survives device loss WebAuthn uses public\-key credentials scoped to a relying party\. The service verifies a signed challenge\. Credential availability after device loss depends on the authenticator and its backup or synchronization model\. Do not assume every passkey follows the same recovery path\. Record which credentials a user can manage, what the interface reveals about them and how the last usable method can be replaced\. For higher\-risk accounts, consider enrolling a second independent authenticator before enforcing passkey\-only access\. ## Walk through three events First, a user adds a new device while the old one still works\. Require appropriate reauthentication and notify the account owner\. Second, a device is lost but another enrolled method remains\. Verify that the owner can revoke the lost credential and review active sessions\. Third, every method is unavailable\. Define the proof, delay, review and notification required for recovery before this case reaches support\. If recovery codes are offered, make them single use, store them appropriately on the service side and explain how the user should keep them offline\. Test the actual interface with a designated test account\. ## Evaluate the fallback as a sign\-in method Measure failed recoveries, support overrides and unexpected credential additions\. Review particularly sensitive accounts separately\. A strong rollout makes legitimate recovery possible while making unauthorized recovery difficult, visible and reversible where possible\. ## Further reading [W3C: Web Authentication]() Related guide: [How to Investigate a Suspicious Login Alert]()\.