Written and maintained by CASRAI Editorial Board
Last updated
Phishing-resistant MFA is multi-factor authentication whose protocol itself prevents a fake website from capturing a login that can be replayed on the real one. The user does not have to spot the fake site. This page is for IT, security and research-computing staff who need to tell which of their sign-in methods qualify, what NIST requires, and how CISA ranks the options. Facts below were read from the NIST, CISA and FIDO Alliance documents cited under Sources on 2026-11-07.
What phishing resistance means
NIST SP 800-63B-4, section 3.2.5, defines phishing resistance as the ability of the authentication protocol to prevent the disclosure of authentication secrets and valid authenticator outputs to an impostor verifier, without relying on the claimant’s vigilance. It is achieved by channel binding (preferred) or by verifier name binding. An authenticator output that a person types in by hand cannot be bound to the session, so it cannot be phishing resistant.
The practical consequence is the attack CISA describes: a user is lured to a look-alike login portal and enters a username, a password and the 6-digit code from an authenticator app. A phishing-resistant method gives that fake site nothing usable.
What counts and what does not
NIST SP 800-63B-4 classifies authenticator types as follows (section numbers are from that document).
| Authenticator type | NIST 800-63B-4 section | Phishing resistant? |
|---|---|---|
| Memorized secret (password) | 3.1.1 | No |
| Look-up secret | 3.1.2 | No |
| Out-of-band authentication | 3.1.3 | No |
| Single-factor OTP | 3.1.4 | No |
| Multi-factor OTP | 3.1.5 | No |
| Single-factor cryptographic authenticator | 3.1.6 | Yes, when it meets 3.2.5 |
| Multi-factor cryptographic authenticator | 3.1.7 | Yes, when it meets 3.2.5 |
NIST also lists subscriber-controlled wallets that present signed, audience-restricted assertions as meeting the phishing-resistance definition. CISA names FIDO/WebAuthn and PKI-based authentication (for example PIV and CAC smart cards) as its phishing-resistant implementations. See how WebAuthn registration and sign-in work for the protocol mechanics.
NIST requirements by assurance level
- AAL2: “Verifiers SHALL offer at least one phishing-resistant authentication option at AAL2.” Other options can still be offered alongside it.
- AAL3: the cryptographic authenticator “SHALL have a non-exportable private key and SHALL provide phishing resistance.”
These are requirements of a technical standard for digital identity services. They are not a general mandate for every organisation.
How CISA ranks MFA options
CISA’s October 2022 fact sheet Implementing Phishing-Resistant MFA calls phishing-resistant MFA the “gold standard”, strongly urges all organizations to adopt it as part of Zero Trust, and notes that the Office of Management and Budget requires agencies to adopt phishing-resistant methods. Its Table 1 orders MFA forms from strongest to weakest:
| Tier (strongest first) | Examples named by CISA | Exposure stated by CISA |
|---|---|---|
| Phishing-resistant | FIDO/WebAuthn; PKI-based | Resistant to phishing; push bombing, SS7 and SIM swap not applicable |
| App-based | OTP; mobile push with number matching; token-based OTP | Vulnerable to phishing; resistant to push bombing for the number-matching and OTP forms; SS7 and SIM swap not applicable to app-based forms |
| App-based without number matching | Mobile push notification without number matching | Vulnerable to push bombing and user error |
| SMS or voice | Code sent by text or voice | Vulnerable to phishing, SS7 and SIM swap; a “last resort” option, usable as a temporary step during transition |
CISA states that FIDO/WebAuthn is the only widely available phishing-resistant authentication, and that PKI-based MFA is less widely available and requires highly mature identity management. It says OTP, push with number matching and token OTP are the best options for small and medium-size businesses that cannot yet move to phishing-resistant MFA, and that any MFA is better than none.
Moving to phishing-resistant MFA
CISA suggests phasing the rollout by asking which resources to protect first (email, file servers, remote access, identity servers such as Active Directory) and which users are high-value targets (system administrators, and staff with broad data access such as HR). It suggests starting with services that already support FIDO, such as most hosted mail and single sign-on systems, and with an initial group such as help desk and IT administrators. Where existing MFA is not phishing resistant, CISA advises added controls such as number matching. Systems that cannot support MFA should be identified and upgraded or replaced; single sign-on integration can often add MFA to them. For federated campus sign-in, see Shibboleth single sign-on and SAML; for the wider control framework, NIST Cybersecurity Framework 2.0 and what cybersecurity covers.
Frequently asked questions
Is MFA with an authenticator app phishing resistant?
No. Under NIST SP 800-63B-4, one-time-password authenticators (3.1.4, 3.1.5) are not phishing resistant, because the code is typed by the user and is not bound to the session. CISA likewise lists OTP as vulnerable to phishing.
Does number matching make push MFA phishing resistant?
No. CISA places push with number matching in the app-based tier, below FIDO/WebAuthn and PKI-based MFA, and recommends it as an added control while migrating.
Are passkeys phishing resistant?
The FIDO Alliance describes passkeys as phishing resistant and secure by design, based on public-key challenge-response, and says device-bound keys on hardware security keys give the highest assurance.
Which NIST level requires it?
AAL2 requires verifiers to offer at least one phishing-resistant option; AAL3 requires the cryptographic authenticator to have a non-exportable private key and provide phishing resistance.
Sources
- NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, pages.nist.gov/800-63-4/sp800-63b.html, sections 2.2.2, 2.3, 3.1, 3.2.5, read 2026-11-07.
- CISA, Implementing Phishing-Resistant MFA, October 2022, read 2026-11-07.
- FIDO Alliance, Passkeys, read 2026-11-07.
