After a scam concern, start by checking whether your important accounts support passkeys on a personal, screen-locked device; the National Cyber Security Centre recommends passkeys where available. Consider a separate password manager if built-in tools do not suit your mix of devices or recovery needs, and a compatible hardware security key for particularly important accounts if you can manage a spare. Check your existing device protections before choosing additional antivirus software: none of these tools can establish whether an unexpected contact is genuine.
If your important accounts offer passkeys and you mainly use personal devices within one ecosystem, a built-in credential manager may cover your sign-in needs. The National Cyber Security Centre recommends using passkeys wherever available.
If you regularly switch browsers or operating systems, compare how a separate password manager handles your passwords, passkeys and recovery. The National Cyber Security Centre identifies a complex mix of devices and browsers as a reason to consider one.
A physical security key may suit accounts where you want a compatible possession-based sign-in method. Check that each service accepts the key and that you can register a spare; Yubico advises registering spare keys separately.
For account and device protection after a scam concern, identify your primary need before comparing tools. Passkey sign-in, credential management, physical authentication and device protection address different parts of the problem.
| Concern | What to check | Who this matters to |
|---|---|---|
| Passkey sign-in | Check that your priority accounts and chosen device or credential manager support passkeys, and use a screen lock on a personal device. | If suspicious sign-in requests worry me, I want to use passkeys on accounts that offer them rather than enter a password there. Around 36% of consumers put passkey sign-in first. |
| Credentials across devices | Check browser and operating-system support, then examine how the manager handles passkeys and account recovery. | Moving between devices makes it hard for me to keep logins organised without losing access. For around 29% of consumers, managing credentials across devices is the primary need. |
| Physical authentication | Check service support, FIDO2 capability if you want passkeys, device connections and spare-key registration. | For an especially important account, I want a physical sign-in factor and a workable backup if the key is lost. That is the first concern for around 21% of consumers. |
| Device threats | Review your existing device protections and compatibility before comparing additional antivirus features. | If my main worry is malware or an unsafe download on my device, account sign-in tools do not address that need on their own. Around 14% of consumers prioritise device-threat protection. |
A password manager or antivirus tool cannot establish who sent a message or made a call. Ofcom advises checking the identity of an unexpected contact independently.
Before acting on a request or disclosing information, contact the organisation through a route you already trust.
Someone who can unlock that device may also be able to use its passkey, as GOV.UK One Login explains.
Create passkeys on personal devices with a screen lock, and remove them from devices you no longer control.
A spare is not a clone of the first key. Yubico advises registering a spare separately with each account it needs to protect.
Check account and device compatibility before choosing a key, then register the spare and retain each service’s recovery method.
Microsoft says Windows Security includes Defender Antivirus and a firewall. Another suite may overlap with protections already active on your device.
Review your Windows version and current protections, then compare additional software against the specific features you need.
A built-in credential-management route for people using Apple devices.
A built-in passkey route associated with Google Accounts and supported devices and browsers.
A separate password manager for people comparing credential use across supported browsers and platforms.
A separate password manager with documented passkey and planned emergency-access features.
A hardware-key route for compatible account sign-in and physical second-factor use.
A Windows-focused security-software route to assess against protections already on your PC.
No. The National Cyber Security Centre explains that a credential manager built into a device can manage passkeys. Consider a separate manager if its supported cross-device or recovery features address a need your built-in setup does not cover.
Avoid doing so if someone else can unlock the device. GOV.UK One Login explains that a person able to unlock a shared device may be able to use its passkey.
It can where the key and account support both uses. Google Account Help distinguishes security keys used for two-step verification from FIDO2 keys used for passkeys; also check your browser and device compatibility.
A separately registered spare and the account’s recovery method give you other ways to regain access. Yubico says its keys cannot be cloned, so enrol a spare with each relevant service before you need it.
Not necessarily: Microsoft says Windows Security includes Defender Antivirus and a firewall. Review what is active on your PC and choose additional software only if its compatible features meet a specific need; antivirus cannot confirm that an unexpected contact is genuine.