Technology

Passkeys can be phished, it’s just much more difficult than with passwords, TOTP MFA, SMS MFA, other OTPs, or push notification-based MFA (e.g., Duo or the way Microsoft, Apple, and Google push a notification to their app and you confirm and/or enter the key).

Passkey is extremely phishing resistant in the same as Webauthn MFA and U2F MFA are, in that origin checks by the browser prevent attackers from initiating the auth process. But it can still be attacked in these ways:

1. XSS bug in the target website
2. Browser vulnerability
3. Malicious browser (not a concern on iOS but a concern everywhere else)
4. Compromise of any cert in the chain between you and the target website
5. Convincing the user to install (or using malware to install) a root certificate, or compromising one you already installed (e.g., for work)
6. Bookmarklet/clipboard/devtools attacks

From memory, passkeys, webauthn, and u2f should prevent over 99% of phishing attacks that are successful without them in place.

There’s also the risk of the passkey itself being compromised, though that level of risk is dependent on your device / how you’re storing your passkeys and isn’t a “phishing” risk.