As password replay loses value in well-implemented passkey environments, account takeover pressure is migrating toward verification, recovery, and fallback paths that still decide who gets in.