What Is Phishing-Resistant MFA?

Quick answer
Phishing-resistant MFA is authentication that an attacker can’t relay or steal from a fake login page.
It’s based on FIDO2 — passkeys or hardware security keys — rather than codes that a human can be tricked into entering.
Regulators and security guidance increasingly name it the baseline over SMS or app-based codes.

What is phishing-resistant MFA?

Phishing-resistant MFA is multi-factor authentication that cannot be defeated by phishing — the attacker’s most effective technique. Standard MFA (SMS codes, authenticator app codes) still fails when a user types the code into a convincing fake site. Phishing-resistant methods, built on the FIDO2 standard, cryptographically bind the authentication to the real site’s origin, so there’s no code for a victim to hand over.

How it works

With a FIDO2 security key or a passkey, the user proves possession of a private key that only answers a challenge from the legitimate website. A phishing site can’t complete the ceremony because the key verifies the site’s origin. Even if an attacker captures everything the victim typed, they have nothing they can replay.

Why it’s becoming the baseline

Because credential phishing is the leading entry vector for account takeover and ransomware, guidance from CISA and others has moved from “use MFA” to “use phishing-resistant MFA” — especially for administrators and anyone with privileged access. Any MFA is better than none, but the standard for high-value accounts has risen.

Where this bites vibecoders
The default “add MFA” an AI assistant suggests is usually SMS or an app code — easy to integrate, but still phishable. For a product where you or your customers hold real accounts, choosing a FIDO2/WebAuthn method from the start removes the single most common takeover path. The integration is harder, which is why it has to be a deliberate choice, not a default.

Where AI coding assistants get this wrong

Defaulting to SMS or TOTP as “MFA” without noting they remain phishable.
Not offering passkeys/WebAuthn as an option for privileged accounts.
Treating any second factor as equivalent, when phishing resistance is the differentiator.

Checklist

Enforce phishing-resistant MFA for administrators and privileged roles.
Offer passkeys or hardware keys as the primary second factor.
Keep weaker MFA only as a fallback for users without FIDO2 devices.
Bind authentication to the origin — no code the user could retype.
Re-evaluate as accounts and privileges grow.

FAQ

Why is SMS MFA considered weaker?

The code is something a human reads and can be tricked into entering on a fake site, and SMS can also be intercepted via SIM swapping. SMS MFA still stops many attacks, but it is not phishing-resistant.

What is the difference between passkeys and hardware keys?

Both are FIDO2-based and phishing-resistant. A hardware key is a physical device (like a YubiKey); a passkey is a software credential that can live on a device or sync across an ecosystem. They’re different forms of the same standard. See What Are Passkeys?.

Is phishing-resistant MFA only for enterprises?

No. Consumer platforms increasingly default to passkeys, and any product with user accounts can offer WebAuthn. The principle — don’t rely on a code a user could type into a fake page — applies at every scale.