Category hub: Credentials, identity and exposure

In one sentence: Phishing-resistant MFA is a way of signing in, such as a security key or passkey, that cannot be handed over to a fake website even if the user is fooled.

What is phishing-resistant MFA?

Ordinary multi-factor authentication (MFA) asks for a code or an approval. If an attacker builds a convincing fake sign-in page, a tricked user can type the code into it, and the attacker uses it at once. The NCSC describes this as a one-time password interception attack. It also describes “prompt bombing”, where a user is flooded with approval requests until they tap yes.

Phishing-resistant MFA removes that weakness. CISA says the only widely available phishing-resistant authentication is FIDO/WebAuthn, and it calls phishing-resistant MFA the gold standard while noting that any MFA is better than none.

How it works

1. When you register a security key or passkey, your device creates a pair of cryptographic keys for that one service.
2. When you sign in, the service sends a challenge.
3. Your device answers only if the website address matches the one it registered with. This is the part that defeats fake sites.
4. You approve with a touch, a PIN or a fingerprint. No code is typed, so there is nothing to hand over.

The NCSC describes FIDO2 as one of the most secure yet usable MFA methods, using standard public-key cryptography. It does not stop every attack. Keep devices patched and protected as well.

Who it affects and how badly

• Sole trader to 10 staff: worth enabling on your email and finance accounts. The NCSC says passkeys are already supported by most modern devices, so cost can be low.
• 10 to 50 and 50 to 250 staff (accountancy, legal, recruitment, SaaS start-ups): start with admins, finance and directors, who are the likeliest targets.
• 250 plus and regulated firms (fintech, councils, healthcare): CISA suggests a phased rollout, starting with groups such as help desk and IT administrators.

Real examples

CISA published a success story on the US Department of Agriculture. By enabling FIDO in its central sign-on system, USDA protected over 600 applications from advanced MFA bypass techniques, and about 40,000 users could sign in without passwords: CISA case study.

How to detect it

• Report which accounts still use phishable methods such as SMS, authenticator codes or simple push approvals.
• Review sign-in logs for users whose sign-ins used weaker methods when stronger ones were available.
• Watch for staff reports of unprompted approval requests.
• Check which services in use do not support stronger MFA at all.

How to fix or prevent it

1. Choose a service and identity provider that supports FIDO2 or passkeys. The NCSC advises preferring services that support phishing-resistance.
2. Roll out to high-risk users first, as CISA suggests: administrators, help desk, finance and directors.
3. Enrol at least two authenticators per person, so a lost key does not lock them out.
4. Use a Conditional Access authentication strength policy in Microsoft Entra to require it for sensitive apps. Entra has built-in Multifactor, Passwordless MFA and Phishing-resistant MFA strengths.
5. Remove weaker fallbacks once people are enrolled, including SMS recovery.
6. If you cannot move yet, use push approval with number matching as a stop-gap. CISA says this is not phishing-resistant.

Related terms

• multi-factor-authentication
• passkeys
• mfa-fatigue-attack
• adversary-in-the-middle-phishing
• conditional-access
• whaling

Also read: brute-force-attack.

Frequently asked questions

What is phishing-resistant MFA?
It is a way of signing in, such as a security key or passkey, that cannot be handed over to a fake website even if the user is fooled.

Why is ordinary MFA not enough?
A tricked user can type a code into a fake sign-in page, and the attacker uses it at once.

Who should get it first?
CISA suggests a phased rollout starting with administrators, help desk, finance and directors, with at least two authenticators per person.

How Wolfcore helps

Breachy checks whether your staff email addresses and passwords are already in known breaches and gives you the exact steps to close each exposure. See Breachy breach exposure monitoring.

Service page: Breachy breach exposure monitoring.