Phishing-resistant MFA is multi-factor authentication that cannot be defeated by phishing, because the credential is cryptographically bound to the legitimate site and never involves a code the user could be tricked into revealing. Passkeys, FIDO2, and hardware security keys are the primary examples.

Regular MFA raised the bar, and attackers responded by learning to phish it. Phishing-resistant MFA closes that gap by removing the thing phishing steals.

Why ordinary MFA gets phished

SMS codes, authenticator-app codes, and push approvals all rely on the user handling something an attacker can capture. A real-time phishing proxy shows the victim a convincing fake login, relays their password and one-time code to the real site instantly, and steals the session. The user did everything "right" and still got compromised, because the factor was relayable.

What makes MFA phishing-resistant

Phishing resistance comes from origin binding. A passkey (built on FIDO2/WebAuthn) is tied to the exact site it was registered with, so it simply will not produce a valid authentication on a lookalike domain. There is no code to read out and no approval to relay, which defeats real-time phishing and adversary-in-the-middle attacks at the structural level rather than hoping the user spots the fake.

Why it matters

Because attackers now routinely bypass phishable MFA, standards bodies and regulators increasingly point to phishing-resistant methods for anything high-value. For financial institutions especially, moving high-risk actions and privileged access to phishing-resistant MFA is one of the clearest security upgrades available.

Frequently asked questions

What is phishing-resistant MFA?

MFA that can’t be defeated by phishing because the credential is bound to the legitimate site and involves no relayable code.

What methods are phishing-resistant?

Passkeys, FIDO2, and hardware security keys.

Why is ordinary MFA not phishing-resistant?

SMS, app codes, and push can be relayed by real-time phishing proxies, which capture and forward the code or approval.

Related: Multi-Factor Authentication (MFA) · Passkeys · FIDO2 · WebAuthn · Phishing