A hardware security key can confirm a login using public-key cryptography tied to the genuine website. Unlike a code typed into a phishing page, the credential is designed not to authenticate for the attacker’s domain.
Protect the accounts that can reset others
Exchange security depends on the linked email account and sometimes the mobile carrier. Strong authentication should cover those recovery paths as well as the exchange itself.
Origin binding blocks many phishing attempts
A security key will not produce a valid login response for a lookalike domain that lacks the real site identity.
Enroll a backup before an emergency
A spare key stored securely can prevent lockout if the daily key is lost or damaged. Recovery codes should be protected separately, and old keys should be removed promptly when no longer controlled.
Recovery codes are equivalent to a spare key
They should be stored offline or in a separately protected location and removed if exposed.
Sources
Educational information, not investment advice.