Supervised help-desk recovery when a passkey or security key goes missing

When an employee loses a passkey or security key, a branch supervisor checks them in person and approves with their own FIDO2 key. A separate help-desk agent approves with a different key. Both approvals are required. A one-time pass then appears on the employee’s screen so they can register a replacement.

If the employee still has their key, the employee and a help-desk agent each use their own key before a password reset, an MFA reset, or another account change.