What is phishing-resistant MFA?
Phishing-resistant MFA is multi-factor authentication that a fake sign-in page cannot capture or relay. Passkeys and FIDO2 security keys bind the sign-in to the real website’s domain, so a lookalike site gets nothing it can use.
How it works
One-time codes, push prompts and SMS codes can all be phished: the victim types or approves them on the attacker’s page. FIDO2 and passkeys use public-key cryptography tied to the genuine site.
Rollouts usually start with administrators, executives and other high-access users, then extend to everyone.
Why it matters
Adversary-in-the-middle phishing kits defeat most MFA. Phishing-resistant methods close that gap for the accounts attackers want most.
