Smash Security Threats Like Pro!
Transmit Security is serving up unbeatable protection – and custom pickleball paddles at RSA 2025. Book a meeting to grab yours and take your security game to the next level!
Transmit Security is serving up unbeatable protection – and custom pickleball paddles at RSA 2025. Book a meeting to grab yours and take your security game to the next level!
Glossary
Phishing-resistant MFA is multi-factor authentication that cannot be defeated by phishing, because the credential is cryptographically bound to the legitimate site and never involves a code the user could be tricked into revealing. Passkeys, FIDO2, and hardware security keys are the primary examples.
Regular MFA raised the bar, and attackers responded by learning to phish it. Phishing-resistant MFA closes that gap by removing the thing phishing steals.
SMS codes, authenticator-app codes, and push approvals all rely on the user handling something an attacker can capture. A real-time phishing proxy shows the victim a convincing fake login, relays their password and one-time code to the real site instantly, and steals the session. The user did everything "right" and still got compromised, because the factor was relayable.
Phishing resistance comes from origin binding. A passkey (built on FIDO2/WebAuthn) is tied to the exact site it was registered with, so it simply will not produce a valid authentication on a lookalike domain. There is no code to read out and no approval to relay, which defeats real-time phishing and adversary-in-the-middle attacks at the structural level rather than hoping the user spots the fake.
Because attackers now routinely bypass phishable MFA, standards bodies and regulators increasingly point to phishing-resistant methods for anything high-value. For financial institutions especially, moving high-risk actions and privileged access to phishing-resistant MFA is one of the clearest security upgrades available.
What is phishing-resistant MFA?
MFA that can’t be defeated by phishing because the credential is bound to the legitimate site and involves no relayable code.
What methods are phishing-resistant?
Passkeys, FIDO2, and hardware security keys.
Why is ordinary MFA not phishing-resistant?
SMS, app codes, and push can be relayed by real-time phishing proxies, which capture and forward the code or approval.
Related: Multi-Factor Authentication (MFA) · Passkeys · FIDO2 · WebAuthn · Phishing
