Phishing-Resistant MFA: Moving Beyond SMS One-Time Passwords
Multi-factor authentication stops most password attacks. But not all MFA is equal: one-time codes sent by SMS or typed from an app can be phished by a fake login page that relays them to the real site in real time.
How attackers bypass weak MFA
- Adversary-in-the-middle phishing: a proxy site captures the password and the one-time code, then the session cookie.
- MFA fatigue: repeated push prompts until a tired user taps “Approve”.
- SIM swap: taking over a phone number to receive SMS codes.
What “phishing-resistant” means
Methods based on FIDO2/WebAuthn — hardware security keys, platform authenticators and passkeys — bind the login to the real website’s domain. A fake site simply cannot use the credential, no matter how convincing it looks.
A practical rollout
- Start with administrators and finance teams — the highest-value targets.
- Enable number matching on push notifications for everyone else as an interim step.
- Register two authenticators per user so a lost key does not lock them out.
- Apply conditional access: stronger methods for risky sign-ins and sensitive apps.
- Retire SMS as a primary method once alternatives are in place.
Do not forget service accounts
Accounts that cannot use MFA should be restricted by IP, scope and permissions, and reviewed regularly.
We design and roll out modern authentication as part of our IT Security service. Talk to us.
