Why a passkey beats a one-time code under phishing
⚠️ Simulation only. This page captures nothing, contacts no server, and uses no real credentials. Both "login" forms below are local illustrations for the classroom. The address bar shows a login-yourbank-secure.example — a lookalike a real victim would not notice.
One-time-code login (phishable)
You are on a fake page. Whatever you type is "relayed" to the real site by the attacker in real time.
Relayed. The fake page just forwarded your password and code to the real site within seconds. The attacker is now logged in as you. Your MFA "worked" — and you were still compromised.
Passkey / security-key login (phishing-resistant)
Same fake page. But your device checks the real site's address before it will respond.
Refused. Your device saw the address was login-yourbank-secure.example, not the genuine site it registered the passkey for. There is no code to type and nothing to relay, so it simply does not respond. The attacker gets nothing.
Teaching point: the one-time code is a shared secret that a fake page can capture and forward. The passkey is cryptographically bound to the genuine site's origin, so a lookalike page has nothing to steal. This is the credential-access step from Lesson 01 — defeated.