Just a little more precision:

Most people don't understand the different keys and may try any of them to log in. Depending on how the phishing scam is set up, they could grab the active key if someone tries to use it.