What is phishing-resistant MFA?

What is phishing-resistant MFA?

Phishing-resistant MFA is multifactor authentication that an attacker can't capture and replay, even when the user is fooled into visiting a fake sign-in page. The proof of identity is cryptographically bound to the genuine website or connection, so whatever a lookalike site collects is useless at the real one. In practice, two families of methods qualify: FIDO2/WebAuthn credentials, including security keys, passkeys and platform authenticators such as Windows Hello for Business, and certificate-based smart cards such as PIV and CAC. CISA guidance names these two as the widely available phishing-resistant options, and US federal policy in OMB memorandum M-22-09 requires agencies to use phishing-resistant MFA for their staff.

Why ordinary MFA can be phished

Most MFA in use today involves something a person reads, types or approves. That makes it relayable by an adversary-in-the-middle (AiTM) phishing kit, a proxy that sits between the victim and the real site:

1. The victim follows a link to a page that looks exactly like the company sign-in page.
2. The proxy forwards the username and password to the real site in real time.
3. The real site sends an MFA challenge, the proxy shows it to the victim, and the victim enters the code or approves the push.
4. The real site issues a session cookie, which the proxy keeps. The attacker now has a signed-in session, and the user's MFA did exactly what it was designed to do.

SMS and voice codes, TOTP authenticator codes, OTP fobs and push notifications, even with number matching, can all be relayed this way. SMS adds further risk from SIM swapping.

How phishing resistance works

With FIDO2, each credential is bound to one domain, and the browser includes the page's actual origin in the data the authenticator signs. A fake domain gets no signature the real site will accept, and there is nothing for the user to hand over. With smart cards, the user proves possession of a private key inside the TLS or Kerberos exchange with the genuine server, so the proof is tied to that connection. NIST SP 800-63B revision 4, the digital identity guidelines, defines phishing resistance in these terms; revision 3 called the property verifier impersonation resistance.

Rolling out phishing-resistant MFA

• Start with the accounts attackers want most: administrators, identity provider admins, executives, finance staff and anyone who can approve payments.
• Issue at least two authenticators per person, such as two security keys or a key plus a platform passkey, so a lost device doesn't force a weak fallback.
• Remove or restrict weaker methods once users enroll. If SMS remains available as a backup, attackers will steer victims toward it.
• Harden recovery. Re-enrolling after a lost key should require identity proofing, not just a call to the help desk.
• Pair it with session controls, such as compliant-device checks and short session lifetimes, because phishing resistance protects the sign-in, not a session cookie stolen later by malware.

Phishing-resistant vs. phishable methods

Phishing-resistant MFA on the CompTIA Security+ exam

This topic belongs to objective 4.5 on SY0-801, which covers MFA methods and how to choose among them. A scenario where staff entered passwords and codes on a lookalike page and attackers signed in seconds later, or where session cookies were captured through a proxy, wants a phishing-resistant method: FIDO2 security keys, passkeys or smart cards. Tempting wrong answers include shorter OTP windows, push number matching, longer passwords and awareness training alone. Number matching does stop blind approval of repeated push prompts, so it fits an MFA fatigue scenario; when a fake site relays the login, only a phishing-resistant method fixes the problem.