Question Identity
What is phishing-resistant MFA?
Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys, hardware security keys and PKI smart cards are the common examples. SMS codes, authenticator-app codes and push approvals are not phishing-resistant.
What is phishing-resistant MFA? Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys, hardware security keys and PKI smart cards are the common examples. SMS codes, authenticator-app codes and push approvals are not phishing-resistant. Source: https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/ (Cleartext, verified 2026-09-24)
Why codes and prompts fail #
A one-time code proves only that someone had the code. If a user types it into a convincing fake site, the attacker can pass it to the real site within seconds. Push approvals have the same gap: the prompt can’t tell whether the login it approves was started by the user or by an attacker holding their password.[4]
What qualifies #
CISA identifies two families of phishing-resistant MFA: FIDO/WebAuthn authenticators, including passkeys and security keys, and PKI-based methods such as smart cards.[1] Both use a private key that signs a challenge tied to the site, so a relayed response is useless to the attacker.[3]
How NIST uses the term #
NIST SP 800-63B-4 treats phishing resistance as a property of the authentication protocol, and requires it at the highest assurance level, AAL3.[2] SMS and voice codes sit in the separate “restricted” category. See is SMS OTP still allowed under NIST 800-63-4?.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
For staff, CISA’s guidance points to FIDO security keys or PKI smart cards. For customers, synced passkeys are the practical phishing-resistant option at scale.
Fintechs & payment firms
Phishing resistance is a property of the protocol, not the user. Training helps, but only a credential bound to your domain removes the relay attack.
Developers & identity teams
Anything the user can type or approve on a prompt can be relayed. If your MFA design depends on the user noticing the wrong domain, it is not phishing-resistant.
Follow-up questions #
- Is push-notification MFA phishing-resistant?
- No. A user can be tricked into approving a prompt started by an attacker. Number matching reduces push bombing but doesn’t bind the approval to the real site.
- Are authenticator-app codes phishing-resistant?
- No. A time-based code can be typed into a fake site and relayed to the real one within its validity window.
People also ask #
Are synced passkeys phishing-resistant?
Yes. A passkey is bound to the website it was created for, so the browser won’t offer it to a look-alike phishing site, and there is no code to read out. NIST SP 800-63B-4 accepts synced passkeys at AAL2. The new risk moves to the account that syncs them, which needs strong protection of its own.
Full answerHow do banks stop OTP bots?
Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out. Where a code remains, say in the message exactly what it approves and that the bank will never ask for it, and treat a new-device login during an inbound call as a fraud signal.
Full answerIs email OTP safer than SMS OTP?
Not meaningfully. Email codes avoid SIM swaps but can be phished, relayed by OTP bots and stolen through a compromised mailbox, just like SMS codes. Regulators treat them as the same class of risk: the UAE and Philippine rules retire SMS and email codes together.
Full answerWhat is an OTP bot?
An OTP bot is an automated calling or messaging service that impersonates a bank or other service and persuades the victim to read out or type in a one-time passcode, which the criminal uses at the same moment to log in or approve a payment.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “What is phishing-resistant MFA?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/
Markdown link
[What is phishing-resistant MFA?](https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/) (Cleartext, verified 2026-09-24)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. |