What Is Phishing-Resistant MFA? (And Which Methods Qualify)

Short answer: Phishing-resistant MFA is any second factor that cannot be handed to an attacker even if you are fully fooled by a fake login page. In practice that means two things: FIDO2/WebAuthn security keys and passkeys. Everything else — SMS codes, authenticator app codes, push approvals, email links — can be relayed to a real site by a convincing fake, because a human is asked to transfer a secret.

The distinction that actually matters

People rank 2FA methods by how hard they are to steal. That is the wrong axis. The right question is: can I be tricked into giving it away?

Every code-based method shares one structural flaw. You read a secret and type it somewhere. If the “somewhere” is controlled by an attacker, the method fails — no matter how strong the cryptography behind the code. A fake login page forwards your password to the real site, the real site sends a challenge, the fake page asks for your code, you supply it, and it is relayed within the 30-second window. The attacker now holds a valid session.

Phishing-resistant methods remove the human from that transaction entirely. There is no secret for you to read out, and the check of “am I on the real site?” is performed by the browser, using cryptography, not by you squinting at a URL.

How phishing resistance actually works

FIDO2/WebAuthn — the standard behind both security keys and passkeys — does three things that break the attack:

• Origin binding. The credential is cryptographically tied to the exact domain it was registered on. Your key created for google.com will not respond to google-verify-login.com. It does not warn you or ask — it simply has no credential for that origin. A lookalike domain that fools a person does not fool the browser.
• Challenge-response, not shared secrets. The site sends a random challenge; your device signs it with a private key that never leaves the device. There is nothing to intercept, replay, or retype. Compare this with TOTP codes, where both sides hold the same secret.
• No transferable value. Even if an attacker captures the signed response, it is valid only for that one challenge, on that one origin, at that moment.

The result: the most common and most effective attack on 2FA — real-time relay phishing — stops working. Not “becomes harder”. Stops.

What qualifies, and what doesn’t

Phishing-resistant:

• FIDO2 security keys — YubiKey, Titan, Nitrokey, SoloKeys. See what a hardware security key is.
• Passkeys — the same cryptography stored on your phone, laptop or in a password manager. See passkeys vs 2FA and YubiKey vs passkeys.
• Certificate-based authentication (smart cards, PIV) — used mainly in government and large enterprises.

Not phishing-resistant:

• SMS codes — also exposed to SIM swapping, which is a separate problem on top.
• Authenticator app codes (TOTP) — strong against everything except being typed into the wrong box.
• Push approvals — a fake page triggers the real login, you get a genuine prompt, you approve it. Number matching helps against prompt bombing but not against a user who is actively logging in and expects a prompt.
• Email codes and magic links — same relay problem, plus dependence on the email account.
• Backup codes — a static secret, phishable like any other.

Note where TOTP sits. It is genuinely good — vastly better than nothing, immune to SIM swaps, generated offline. It is simply not in the phishing-resistant category, and pretending otherwise leads people to skip the upgrade on accounts where it matters.

Does that mean authenticator apps are obsolete?

No, for a practical reason: coverage. Most banks, most exchanges, most government portals, most smaller SaaS products and a great many large platforms still do not offer passkeys or security keys. LinkedIn, for instance, offers only TOTP and SMS. Until that changes, an authenticator app is the strongest option available on a large share of your accounts.

The sensible model is layered:

1. Passkey or security key wherever it is offered — starting with your email, because email resets everything else.
2. Authenticator app everywhere else.
3. SMS only where nothing else exists — and removed the moment an app becomes available, since your account is only as secure as the weakest method left enabled.

Our complete guide to two-factor authentication covers the ladder in more detail, and can 2FA be hacked? walks through the attacks each rung does and does not stop.

Where phishing-resistant MFA still has gaps

It is not a universal solvent. Three things it does not fix:

• Session cookie theft. If malware steals an authenticated session from your browser, no login is required and the strength of your MFA is irrelevant.
• Account recovery. Attackers who cannot beat your security key will phone support instead. If your recovery path is a phone number and a date of birth, that is now your real security level.
• Weak fallbacks. Registering a security key while leaving SMS enabled achieves very little. The attacker will simply choose the SMS route.

That last point is the most common implementation mistake, in organisations and personal accounts alike.

Frequently asked questions

Is a passkey as phishing-resistant as a hardware key?

Against phishing, yes — both use origin-bound FIDO2 credentials. They differ in where the private key lives: a hardware key never syncs, while a passkey usually syncs through iCloud, Google or a password manager. That makes passkeys easier to recover and hardware keys harder to compromise at scale.

Why is TOTP not phishing-resistant if the code changes every 30 seconds?

Because 30 seconds is plenty. Relay attacks are automated and complete in under a second. The code’s short life protects against replay much later; it does nothing against real-time forwarding.

Does number matching make push notifications phishing-resistant?

No. Number matching defeats blind approval — you must read a number from the login screen and type it into the app. But in a phishing scenario the attacker’s page can display that number to you. It is a strong fix for prompt bombing, not for phishing.

Do I need to buy a security key, or is a passkey enough?

For most people a passkey is enough and free. Buy hardware keys if you are a high-value target — an executive, a journalist, a crypto holder, an admin of critical systems — or if you want a factor that cannot be reached through a compromised cloud account. If you buy one, buy two and register both.

Which services support phishing-resistant MFA today?

Google, Microsoft, Apple, Amazon, GitHub, X, Cloudflare, most major password managers, and a growing number of financial platforms. Coverage improves steadily — it is worth rechecking the security settings of your important accounts once a year.

What should I do first?

Add a passkey to your primary email account. It is the single highest-impact change available, because every other account’s password reset flows through it. Then work down your list by what you cannot afford to lose.

The bottom line

Phishing-resistant MFA is not a marketing tier, it is a structural property: the second factor cannot be transferred to an attacker by a person who has been convinced to hand it over. Only FIDO2 keys and passkeys have it. Use them where you can, use an authenticator app everywhere else, remove SMS fallbacks, and remember that your account recovery path is part of your security whether you designed it or not.

Still on codes for most things? Generate and verify them with our free browser-based 2FA code generator.