Phishing-resistant MFA: FIDO2 and passkeys

For ten years, the advice was simple: turn on MFA. It still holds, but it is no longer enough. Common phishing campaigns relay the six-digit code or the push notification in real time, and the user who "does everything right" still grants access. The two reference authorities, CISA and NIST, now say the same thing: not all MFA is equal, and only one family resists phishing.

What the sources say

CISA's fact sheet on phishing-resistant MFA, published in October 2022, ranks the forms of MFA from strongest to weakest. At the top, phishing-resistant MFA: FIDO/WebAuthn authentication and PKI-based MFA, immune to phishing, push bombing, SS7 attacks and SIM swap. Next, one-time-password apps and push notifications with number matching: resistant to push bombing, but vulnerable to phishing. Then push notification without number matching, vulnerable to push bombing and user error. Last, SMS or voice, vulnerable to phishing, SS7 attacks and SIM swap, to be used only as a last resort and temporarily. The fact sheet states that "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication", and CISA's MFA page adds that, faced with a fake site, "the FIDO protocol will block the attempt".

NIST, in revision 4 of SP 800-63B published in July 2025, gives the definition: phishing resistance is "the ability of the authentication protocol to prevent the disclosure of authentication secrets and valid authenticator outputs to an impostor verifier without relying on the vigilance of the claimant". Two mechanisms achieve it: channel binding and verifier name binding, of which WebAuthn is the example, since the output is bound to the authenticated domain name of the service. The consequence is explicit: "authenticators that involve the manual entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be considered phishing-resistant". NIST requires verifiers to offer at least one phishing-resistant option at AAL2, mandates it at AAL3, and requires federal agencies to demand it from their staff, contractors and partners. Syncable authenticators, that is, passkeys copied between devices, are admitted, but not at AAL3. Out-of-band authentication over the telephone network (SMS, voice) is classified as "restricted": the verifier must offer an alternative, warn the user, and consider risk indicators such as a SIM change or number porting.

Why it matters

The difference is not a shade of security; it is a difference in kind. A code, whatever its channel, is a secret the user can give to the wrong person; a fake portal only has to relay it. A FIDO key cannot be "given": it signs a challenge for a precise domain, and the fake domain receives nothing useful. That is why CISA speaks of the "gold standard" and why NIST withdraws the qualification from anything typed on a keyboard.

For organizations, this translates concretely. Administrator, help desk and finance accounts protected by SMS or push are the ones attackers target, because the return on effort is best. The frameworks follow: ISO 27001 (control 8.5, secure authentication), SOC 2 (CC6 criteria) and NIS2, whose article 21 cites multi-factor authentication among the expected measures, all require authentication proportionate to risk, and Law 25 requires reasonable security measures for personal information.

What we think at Sentrix

The migration succeeds when it is treated as an identity project, not as a token rollout. In order:

1. Inventory the methods actually in use per application and per population: most directories report it, and the result is often that SMS remains active "just in case" on the most sensitive accounts.
2. Start with the high-value targets: administrators, help desk, executives, finance, as CISA recommends, on the services that already support FIDO (hosted email and single sign-on).
3. Physical FIDO2 keys for privileged accounts, passkeys for everyone: the former for the highest assurance level, the latter for coverage.
4. Number matching as a transition, never as a destination, on the applications that do not yet support FIDO, with an end date.
5. Retire SMS method by method, offering every user an alternative, as NIST requires, and watching the telephone risk indicators until then.
6. Keep the evidence: policy, inventory, retirement dates, approved exceptions. That is what the ISO 27001 or SOC 2 auditor will ask for, and our identity and access service structures that file.

The next step

Pull the list of your administrator accounts and the MFA method of each. If a single line says SMS or push without number matching, that is your project for the quarter. It fits in a few weeks for that population, and it removes the most profitable attack from your surface.