# What is phishing-resistant MFA?

> **Short answer:** Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys, hardware security keys and PKI smart cards are the common examples. SMS codes, authenticator-app codes and push approvals are not phishing-resistant.

- URL: https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

## Why codes and prompts fail

A one-time code proves only that someone had the code. If a user types it into a convincing fake site, the attacker can pass it to the real site within seconds. Push approvals have the same gap: the prompt can’t tell whether the login it approves was started by the user or by an attacker holding their password.[^4]

## What qualifies

CISA identifies two families of phishing-resistant MFA: FIDO/WebAuthn authenticators, including passkeys and security keys, and PKI-based methods such as smart cards.[^1] Both use a private key that signs a challenge tied to the site, so a relayed response is useless to the attacker.[^3]

## How NIST uses the term

NIST SP 800-63B-4 treats phishing resistance as a property of the authentication protocol, and requires it at the highest assurance level, AAL3.[^2] SMS and voice codes sit in the separate “restricted” category. See [is SMS OTP still allowed under NIST 800-63-4?](https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/).

## What this means for you

### Banks & credit unions

For staff, CISA’s guidance points to FIDO security keys or PKI smart cards. For customers, synced passkeys are the practical phishing-resistant option at scale.

### Fintechs & payment firms

Phishing resistance is a property of the protocol, not the user. Training helps, but only a credential bound to your domain removes the relay attack.

### Developers & identity teams

Anything the user can type or approve on a prompt can be relayed. If your MFA design depends on the user noticing the wrong domain, it is not phishing-resistant.

## Follow-up questions

**Is push-notification MFA phishing-resistant?**

No. A user can be tricked into approving a prompt started by an attacker. Number matching reduces push bombing but doesn’t bind the approval to the real site.

**Are authenticator-app codes phishing-resistant?**

No. A time-based code can be typed into a fake site and relayed to the real one within its validity window.


## Sources

[^1]: Implementing Phishing-Resistant MFA (fact sheet). CISA, 2022-10. https://www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
[^2]: SP 800-63B-4: Authentication and Authenticator Management. NIST. https://pages.nist.gov/800-63-4/sp800-63b.html
[^3]: Web Authentication: An API for accessing Public Key Credentials. W3C. https://www.w3.org/TR/webauthn/
[^4]: Implementing Number Matching in MFA Applications (fact sheet). CISA, 2022-10. https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf

## Related questions

- [Are synced passkeys phishing-resistant?](https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/)
- [How do banks stop OTP bots?](https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/)
- [Is email OTP safer than SMS OTP?](https://glide-cleartext.pages.dev/q/is-email-otp-safer-than-sms/)
- [What is an OTP bot?](https://glide-cleartext.pages.dev/q/what-is-an-otp-bot/)

## Cite

Cleartext. “What is phishing-resistant MFA?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/what-is-phishing-resistant-mfa/

## Changelog

- 2026-09-24: First published.