Phishing-Resistant MFA: Why Text Codes and Push Prompts Aren't Enough

What is phishing-resistant MFA?

Phishing-resistant MFA is a second factor that won’t work on a fake website. The authenticator signs a challenge that’s tied to the real site’s address, so a look-alike page gets nothing it can reuse. NIST’s SP 800-63B-4 (August 2025) calls this “verifier name binding” and “channel binding.” Codes you type in by hand don’t count.

NIST is blunt about it: authenticators that involve “manual entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be considered phishing-resistant.” That covers the six-digit code from a text message and the six-digit code from an authenticator app. If a person can read it and type it, a person can type it into the wrong page.

CISA’s fact sheet Implementing Phishing-Resistant MFA (October 2022) says “any form of MFA is better than no MFA,” and then calls phishing-resistant MFA “the gold standard.” It says organizations “should make migrating to it a high priority effort.”

Why do text codes and push prompts get phished?

Because the attacker doesn’t need to break them. They just ask for them. The two common ways in are adversary-in-the-middle (AiTM) phishing pages and push fatigue. Both get past MFA that’s turned on and working. Neither works against a FIDO2 key or a passkey.

Adversary-in-the-middle. The user clicks a link and lands on a page that looks exactly like their Microsoft or Google sign-in. Behind it, the attacker’s server is passing everything back and forth to the real sign-in page. The user types the password, then the code, and the real site issues a session. The attacker keeps that session cookie. Microsoft documented one AiTM campaign that tried to target more than 10,000 organizations starting in September 2021. In some cases it took “as little time as five minutes” from the stolen session to payment fraud. Microsoft says the attacker gets in “regardless of the sign-in method” the user picks, as long as that method can be relayed.

Push fatigue. CISA calls this “push bombing.” The attacker already has the password and keeps triggering sign-in prompts on the user’s phone “until they press the ‘Accept’ button.” Number matching helps here. CISA lists push with number matching as resistant to push bombing, but still “vulnerable to phishing attacks.”

SMS on its own is the weakest option. CISA lists text and voice codes as open to phishing, SIM swap, and SS7 attacks. It says they “should only be used as a last resort.” NIST’s current guidance classifies phone-network codes as “restricted.”

That’s the problem in plain terms. Business email compromise is mostly a login problem, and our guide to business email compromise walks through how one turns into a redirected payment.

What counts as phishing-resistant?

Three families of authenticator qualify. Both CISA and OMB name the same ones: FIDO2/WebAuthn and PKI-based smart cards. Passkeys are FIDO2 credentials, so they count too. CISA puts it this way: “The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication.”

• FIDO2 security keys. A small USB or NFC key. CISA calls these “roaming” authenticators. You tap it to sign in. It’s tied to one person, not to a phone number.
• Passkeys. The FIDO Alliance defines a passkey as “an authentication credential based on FIDO standards” stored on a phone, a computer, or a hardware key. Some sync across your devices through a cloud account. Others never leave one device, like a passkey on a security key. Windows Hello for Business is the platform version that lives in the laptop itself.
• PKI smart cards. Certificate-based sign-in, like the federal PIV card. CISA says it “requires highly mature identity management practices.” For most small firms, keys and passkeys are the easier path.

The federal government already made this call for its own staff. OMB memo M-22-09 (January 26, 2022) says that for agency staff, contractors, and partners, “phishing-resistant MFA is required.” It also tells agencies to drop methods “that fail to resist phishing, including protocols that register phone numbers for SMS or voice calls, supply one-time codes, or receive push notifications.” It names PIV and Web Authentication as the approaches that work.

Who should get phishing-resistant MFA first?

Start with the accounts an attacker would pick: people who move money and people with admin rights. CISA says to ask “Which users are high-value targets?” and suggests help desk and IT administrators for a first phase. It also lists attorneys with e-discovery access and HR staff as high-value targets.

For a firm that wires money or holds client data, I’d add one group to CISA’s list:

1. Anyone who sends wires, approves payments, or can change payment instructions. At a title company that’s the funding desk and closers. At an accounting or advisory firm it’s whoever can move client money.
2. Every admin account in Microsoft 365, Google Workspace, and your line-of-business software. An admin can turn off everyone else’s protection.
3. Owners and partners. Their names carry the authority attackers want to borrow.
4. Everyone else, once the first groups are working and you’ve sorted out recovery.

This is what we did after the BEC wire fraud case at a title company. Org-wide 2-Step Verification enforcement went on the same day. Hardware security keys for funding staff followed over the next week. Under our baseline, funding staff get hardware keys on top of enforced MFA. If you run a title shop, our page on managed IT for title companies covers the rest of the wire fraud controls.

CISA also says to start with “the services that do support phishing-resistant MFA,” and notes that “most hosted mail and SSO systems support FIDO.” Your email is the right place to begin.

How do you enforce it in Microsoft 365 or Google Workspace?

Turning it on isn’t enough. You have to require it, or users will fall back to the code their attacker can relay. Both platforms can do this. The setting lives in a different place in each one, and you should test it on a small group before you apply it to everyone.

Microsoft 365 (Entra ID). Use a Conditional Access policy with the Require authentication strength control, set to the built-in Phishing-resistant MFA strength. Per Microsoft’s documentation, that strength allows FIDO2 security keys, Windows Hello for Business or platform credentials, and multifactor certificate-based authentication. Text messages, push, and app codes don’t satisfy it. Conditional Access needs a Microsoft Entra ID P1 license, so check what your plan includes. Scope the first policy to your money and admin groups, and keep a break-glass admin account out of it.

Google Workspace. In the 2-Step Verification settings, Google’s admin guide offers three choices for allowed methods. Pick Only security key for the groups that move money and the admins. Google notes that this option “now supports both security keys and passkeys” and that the two “have the same level of phishing protection.” If you can’t go that far yet, Any except verification codes via text, phone call at least takes SMS off the table.

Before you flip either switch, plan for the lost key. Give each person two keys, register both, and keep the spare somewhere safe. Write down how someone gets back in that doesn’t involve a text message, because that’s the door attackers will knock on next. Our Microsoft 365 administration work treats recovery as part of the rollout, not something to figure out the first time someone loses a key.

Key takeaways

What this looks like when we do it

We start by listing who can move money, who can change payment details, and who has admin rights. Those people get FIDO2 keys or passkeys first. Then we put the enforcement policy on that group in Microsoft 365 or Google Workspace, so the weaker methods stop working for them. MFA is enforced across the whole tenant before any of that, not left as something each user can opt into. Once the first group is stable, we widen the policy.

We also look at what’s already in the tenant: users still on text-message codes and admin accounts with no MFA at all. Our Microsoft 365 administration baseline covers tenant security, enforced MFA, mail-flow rules, and sign-in monitoring. Keys are one control. Out-of-band wire verification still matters, because a perfect login doesn’t stop a spoofed email from outside your firm.

Want to know which of your people should be on keys first? Book a call and we’ll walk your tenant with you.