What Is Phishing-Resistant MFA?
Not all multi-factor authentication is equal. Most common MFA — one-time codes, push approvals — can be defeated in real time by a convincing phishing site. Phishing-resistant MFA closes that gap by binding the credential to the real site’s origin, so a fake page gets nothing. It is the strongest practical defense against account takeover.
Why can ordinary MFA be phished?#
Because it depends on the user relaying something an attacker can reuse:
| Method | How it’s phished |
|---|---|
| SMS / TOTP codes | Victim types the code into a fake site; attacker relays it |
| Push approval | Attacker spams prompts until the user taps approve (MFA fatigue) |
In each case, the second factor is not tied to which site is asking, so an attacker-in-the-middle simply passes it along in real time. The user did everything “right” and was still phished.
What makes MFA phishing-resistant?#
Origin binding. Phishing-resistant methods — FIDO2/WebAuthn security keys and passkeys — use a cryptographic credential the browser will only release to the exact site it was created for:
- No code to type, nothing to relay.
- The credential simply does not work on a look-alike domain.
- Even a perfect phishing replica of your site captures nothing usable.
Phishing-resistant MFA attacks the root of credential theft. More at the Defense & Hardening hub.
Frequently asked questions#
What is phishing-resistant MFA?
Phishing-resistant MFA is multi-factor authentication that cannot be defeated by tricking a user on a fake site. It uses cryptographic credentials bound to the legitimate site’s origin — like FIDO2/WebAuthn security keys and passkeys — so a phishing page cannot relay or reuse the authentication. There is no code to type and nothing to hand over.
Why can codes and push notifications be phished?
Because they rely on the user, who can be tricked. An attacker-in-the-middle phishing site prompts the victim for their one-time code, or spams push approvals until the user taps "approve." Because the code or approval is not bound to the real site, the attacker relays it in real time. Origin-bound credentials remove that possibility.