Cybersecurity glossary
What is Phishing-Resistant MFA?
Learn what phishing-resistant MFA is, why SMS and TOTP still fall to real-time phishing, which authenticators qualify, and how to deploy phishing-resistant MFA for high-risk users.
Definition
Phishing-resistant MFA is multi-factor authentication that cannot be completed successfully by tricking a user into revealing a reusable secret or approving a bogus login on an attacker-controlled lookalike site—typically achieved with FIDO2/WebAuthn cryptographic authenticators bound to the legitimate origin.
Why “we have MFA” stopped being enough
Modern phishing kits proxy real login pages and harvest passwords plus OTP codes live. Classic MFA still fires—and still fails. Phishing-resistant MFA closes that relay path by refusing to emit a transferable secret for the wrong origin.
It is now a baseline expectation for privileged and remote access programs.
What makes an authenticator phishing-resistant
Origin binding
Cryptographic assertions are valid only for the legitimate relying party ID.
No typed secrets
Users do not copy codes attackers can paste into a proxy.
Private keys stay local
Authenticators hold keys in hardware or platform secure storage.
User verification
PIN or biometrics prove presence without sending biometrics to the site.
Mitigates push fatigue
No Approve button storm to socially engineer.
Works with SSO
Enforce at the IdP to protect many apps at once.
Phishable vs resistant methods
| Method | Phishing-resistant? | Why |
|---|---|---|
| SMS / email OTP | No | Codes are relayable |
| TOTP app | No | Codes are relayable |
| Push approve | No | Fatigue and social engineering |
| Number-matching push | No | User can still read number to attacker |
| FIDO2 / passkeys | Yes | Origin-bound signatures |
Deployment path
Prioritize high-risk identities
Admins, VPN/SSO, email, and finance first.
Issue authenticators
Passkeys and/or hardware keys with backups.
Enforce at the IdP
Conditional access requires phishing-resistant methods for those cohorts.
Fix recovery
Remove easy OTP/password fallbacks that undo the control.
Expand and measure
Track coverage, lockouts, and phishing simulation outcomes.
Hardening checklist
- Mandate phishing-resistant MFA for privileged and remote access users.
- Prefer FIDO2/WebAuthn passkeys and security keys over OTP and push.
- Register spare authenticators before enforcement day.
- Disable phishable fallbacks for enforced cohorts wherever policy allows.
- Audit help-desk identity proofing for account recovery.
- Monitor authenticator registration and removal events.
- Pair with session controls so cookie theft is still constrained.
- Test against adversary-in-the-middle phishing kits in purple-team exercises.
The practical takeaway
Phishing-resistant MFA is MFA that survives fake login pages and real-time relays. OTPs and push prompts usually do not; FIDO2/passkeys usually do.
Prioritize it for the identities attackers want most, and protect enrollment and recovery so the strong factor cannot be administratively bypassed.
Related security terms
FIDO2
Primary standards family used to implement phishing-resistant MFA.
Passkey
User-friendly phishing-resistant authenticator experience.
Hardware Security Key
Roaming authenticator commonly mandated for admins.
MFA Fatigue
Push MFA failure mode that phishing-resistant methods avoid.
Multi-Factor Authentication (MFA)
Broader MFA category that includes weaker phishable methods.
Frequently asked questions
What is phishing-resistant MFA in simple terms?
It is MFA that still works even if someone builds a fake login page—because your device signs a challenge for the real site and will not produce a secret the attacker can replay elsewhere.
Why are SMS and authenticator OTPs not phishing-resistant?
Users can type those codes into a phishing site. Attackers relay them to the real service in real time (adversary-in-the-middle).
Which methods are considered phishing-resistant?
FIDO2 security keys, platform passkeys/WebAuthn authenticators, and some smart-card/PKI approaches that cryptographically bind to the legitimate service.
Is number-matching push MFA phishing-resistant?
No. It reduces accidental approvals and fatigue success rates but users can still be socially engineered into entering the matching number for an attacker session.
Who should get phishing-resistant MFA first?
Administrators, remote access users, executives, finance, and anyone who can change identity or security settings.
What does CISA recommend?
CISA strongly encourages phishing-resistant MFA—particularly FIDO/WebAuthn—for protecting against modern phishing kits.
Can weak recovery bypass phishing-resistant MFA?
Yes. If help desks reset accounts with weak identity proofing, attackers skip the strong authenticator entirely.
References
Explore authoritative guidance and frameworks related to phishing-resistant mfa.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.