Identity & Access Management
Phishing-Resistant MFA: Why Passkeys and FIDO2 Are Replacing OTPs
Most organizations already use MFA — and most are still being breached through it. The reason is simple: traditional MFA factors like SMS codes and authenticator-app one-time passcodes can be stolen by a convincing fake login page. The user types the code, the attacker relays it to the real site, and the “second factor” provides no protection at all. Phishing-resistant MFA closes this gap at the protocol level. This guide explains how it works, why it’s different, and how to roll it out.
Why Traditional MFA Still Gets Phished
The weakness of older MFA is that the second factor is just information the user can be tricked into handing over. Consider how a modern phishing attack works:
- The attacker sends a link to a fake login page that looks identical to the real one.
- The user enters their password — captured.
- The page prompts for the SMS or app code; the user enters it — also captured.
- The attacker instantly relays both to the genuine site and logs in.
This is called an adversary-in-the-middle (AiTM) attack, and ready-made phishing kits automate the entire process. Because the one-time code carries no proof of which website asked for it, it works just as well on the attacker’s page as on the real one. SMS adds further weaknesses: SIM-swapping and SS7 network interception let attackers receive codes without touching the user at all.
What Makes MFA “Phishing-Resistant”
Phishing-resistant MFA is built on public-key cryptography and a property called origin binding. When a user registers, their device generates a unique key pair for that specific website. The private key never leaves the device, and the credential is cryptographically tied to the real site’s domain.
That single design choice defeats phishing: if a user lands on a look-alike domain, the authenticator simply refuses to respond, because the origin doesn’t match. There is no code to type, nothing to relay, and nothing for an attacker to capture. The standard behind this is FIDO2, developed by the FIDO Alliance and the W3C (the WebAuthn specification).
Passkeys and FIDO2 Explained
These terms are related but not identical:
FIDO2
The open standard that defines phishing-resistant, public-key authentication for the web. Everything below is an implementation of FIDO2.
Hardware security keys
Physical devices (such as a YubiKey) that store the private key. The user plugs in or taps the key to authenticate. Strongest option for high-risk and administrative accounts because the credential lives on dedicated hardware.
Passkeys
A user-friendly FIDO2 credential stored on a phone or computer and unlocked with a biometric or PIN. Passkeys can sync across a user’s devices (via the platform’s cloud), making them far more convenient than hardware keys while remaining phishing-resistant. They are the format driving mainstream adoption.
Phishing-Resistant MFA vs Traditional MFA
| Method | Phishable? | SIM-swap risk? | Best use |
|---|---|---|---|
| SMS OTP | Yes | Yes | Last resort only |
| Authenticator app (TOTP) | Yes | No | Low-risk accounts |
| Push approval | Yes (MFA fatigue) | No | Low-risk, with number-matching |
| Passkey (FIDO2) | No | No | All users |
| Hardware security key (FIDO2) | No | No | Admins & privileged access |
How to Roll Out Phishing-Resistant MFA
A phased approach minimizes disruption while protecting your riskiest accounts first:
- Start with privileged accounts. Administrators and privileged users are the highest-value targets — give them hardware security keys first.
- Enable FIDO2/passkeys in your identity provider. Major platforms (Microsoft Entra ID, Okta, Google) support phishing-resistant methods natively.
- Run a pilot. Roll out to a small group, refine enrollment and recovery flows, and document the user experience.
- Expand to all users with passkeys, which balance security and convenience for the general workforce.
- Phase out SMS as a primary factor, keeping it (if at all) only as a tightly controlled fallback.
- Harden account recovery. Attackers shift to recovery flows once login is locked down — treat recovery with the same rigor as authentication.
Where Phishing-Resistant MFA Fits in Your Security Strategy
Phishing-resistant MFA is the strongest form of the identity pillar in a Zero Trust security model. Strong authentication confirms who is logging in, but it works best alongside privileged access management (PAM), which controls what they can do once inside. Together they shrink both the likelihood of compromise and the damage any single breach can cause. If you’re still mapping the basics, our guide on MFA vs 2FA covers the foundational terminology.
Frequently Asked Questions
What is phishing-resistant MFA?
Phishing-resistant MFA is multi-factor authentication that cannot be tricked by fake login pages or intercepted codes. It uses public-key cryptography bound to the legitimate website’s domain, so the credential only responds to the real site. Passkeys and FIDO2 security keys are the main examples.
Why is SMS-based MFA not phishing-resistant?
SMS and app-generated one-time codes can be entered into a fake login page and relayed by an attacker to the real site in real time. The code itself carries no proof of which site requested it, so it can be phished, intercepted via SIM-swapping, or captured by adversary-in-the-middle attacks.
Are passkeys the same as FIDO2?
Passkeys are a user-friendly implementation of the FIDO2 standard. FIDO2 is the underlying open standard (from the FIDO Alliance and W3C WebAuthn) for phishing-resistant authentication. A passkey is a FIDO2 credential that can sync across a user’s devices, while a hardware security key is a FIDO2 credential stored on a physical device.
Is phishing-resistant MFA required for compliance?
It is increasingly expected. Frameworks and guidance such as NIST SP 800-63 and various government mandates now recommend or require phishing-resistant authentication for privileged and high-value access. Even where not strictly required, it is widely treated as best practice for administrative accounts.
Can phishing-resistant MFA be bypassed?
No authentication method is absolute, but properly implemented FIDO2/passkey authentication defeats the credential-phishing and adversary-in-the-middle attacks that compromise most accounts. Residual risks shift to areas like account-recovery flows and device theft, which is why it should be paired with strong recovery policies and least-privilege access.
How do we start rolling out passkeys?
Begin with your highest-risk accounts: administrators and privileged users. Enable FIDO2/passkey support in your identity provider, distribute hardware keys or enable platform passkeys, run a pilot group, then expand to all users while phasing out SMS as a primary factor.
Deploy Phishing-Resistant MFA with ARKSOFT
Moving from SMS codes to passkeys and FIDO2 across an enterprise takes planning — from identity-provider configuration to privileged-account protection and recovery design. ARKSOFT helps organizations deploy phishing-resistant MFA without disrupting users.
Talk to an identity specialist →