NY Consumer Alert Urges Stronger Password Habits
New York's Division of Consumer Protection recommends long, unique passwords, password managers, and passkeys to help protect online accounts.
Updated on Nov. 12, 2026 in Cybersecurity
Live Poll
Have you switched any of your online accounts to passkeys?
The New York Department of State's Division of Consumer Protection issued a consumer alert on November 12, 2026, on password and passkey protection. The division recommends passwords of at least 12 characters that are long, random and unique for each account.
Why it matters
Reused or weak passwords make accounts easier to compromise, and the alert presents password managers, multifactor authentication and passkeys as practical ways for New York residents to reduce that risk. The guidance also notes that passkey systems may not work with every device, operating system, platform or application.
The division recommends a minimum password length of 12 characters and directs residents to its Consumer Assistance Helpline at 800-697-1220. The alert does not quantify how many passkey-enabled services or devices currently exist.
The players
New York Department of State
The New York Department of State is the state agency that oversees business licensing, consumer protection and related regulatory functions for residents and companies in New York.
The details
The alert explains that a password is typed to access an account, while a passkey signs users in using a device PIN, fingerprint or face recognition instead. A passkey pairs a public key held by the website or app with a private key that authenticates the sign-in, and the division describes it as resistant to phishing. A password manager can generate, store and auto-fill unique passwords, unlocked by a strong master password or a supported biometric method.
Timeline
Nov. 12, 2026: Division of Consumer Protection issues consumer alert on passwords and passkeys.
Monday through Friday, 8:30 a.m. to 4:30 p.m.: Consumer Assistance Helpline operating hours.
Roadmap
The alert applies passkey sign-in, which builds on FIDO Alliance standards that replace shared secrets with public-key cryptography. It shows state consumer regulators adopting the same authentication shift that major platforms have been rolling out.
Residents can start by creating a unique passphrase of at least 12 characters for each important account and storing them in a password manager. Turning on passkeys where a service offers them can replace typed passwords for sign-in, though compatibility depends on the device and app.
The takeaway
Strong, unique credentials paired with multifactor authentication or a passkey remain among the simplest defenses against account takeover. Checking that your devices and apps support passkeys before relying on them keeps sign-in access from being lost.
Further reading
For more on protecting accounts, see Cybersecurity coverage on New York's guidance.
Source note: This article includes information reported by Fingerlakes1.
Live Poll
Have you switched any of your online accounts to passkeys?
