If your MFA today is a text message code or a “tap to approve” push notification, you have MFA, but you don’t have protection against the attack that’s actually taking down businesses right now. Phishing-resistant MFA (FIDO2 security keys and passkeys) is what the Cybersecurity and Infrastructure Security Agency (CISA) recommends, and it’s quickly becoming what cyber insurers expect too. Here’s the difference, and why it matters more than most businesses realize.
The attack that makes “any MFA” not enough
Attackers stopped trying to guess passwords a long time ago. The playbook now is simpler: steal the password through a convincing phishing page, then deal with MFA directly.
Two methods do most of the damage:
- Adversary-in-the-middle phishing. A fake login page sits between the victim and the real site, relaying the password and the MFA code in real time and stealing the resulting session cookie. The user sees a normal-looking login. The attacker is in before the session even ends.
- MFA fatigue (push bombing). The attacker already has a valid password and triggers push notification after push notification until an exhausted employee taps “approve” just to make it stop. Microsoft recorded over 382,000 of these attacks against its own user base in a single stretch, and it’s the exact method that compromised Uber in 2022, an attacker combined push bombing with a WhatsApp message posing as IT support until an employee approved a login. Cisco was hit the same year, with attackers pairing MFA prompts with a phone call impersonating IT.
Neither of these requires a sophisticated zero-day. They require patience and an MFA method that can be tricked, which describes most of what businesses are running today.
What actually makes MFA “phishing-resistant”
CISA draws a clear line between MFA types, and it comes down to one question: can the credential be relayed to an attacker, or is it cryptographically bound to the real site you’re logging into?
| Method | Can it be phished? | Verdict |
|---|---|---|
| SMS and voice codes | Yes | Weakest |
| Push approval | Yes | Weak |
| Push with number matching | Still possible | Interim step |
| Passkeys and security keys | No | Gold standard |
| Certificate-based | No | Strong |
- SMS and voice codes. Weakest tier. Vulnerable to SIM-swap attacks and can be phished directly, since the code is just a string of digits a victim can be tricked into typing anywhere.
- Push notification apps (tap to approve): Vulnerable to fatigue/push-bombing attacks, as shown above. “Number matching” (where the user enters a code shown on screen rather than just tapping approve) is a meaningful improvement and the interim step CISA recommends for organizations not yet ready for the next tier, but it’s still phishable by a sufficiently real-looking fake login page.
- FIDO2 / WebAuthn (security keys and passkeys): The gold standard. The authentication is cryptographically bound to the actual website’s domain. A fake login page simply cannot complete the handshake, no matter how convincing it looks. This can run on a physical USB/NFC key (like a YubiKey) or a built-in platform authenticator, such as Windows Hello, Touch ID, Face ID, without requiring additional hardware.
- PKI-based (certificate) authentication: Also phishing-resistant. More common in larger enterprises and government environments with existing smart-card infrastructure.
Why this is showing up on your cyber insurance renewal too
This isn’t just a security best practice anymore; it’s underwriting criteria. Most cyber insurers already require some form of MFA on email, remote access, and administrative accounts as a baseline condition of coverage. The newer shift is that phishing-resistant MFA specifically is starting to show up as a premium credit, alongside things like network segmentation and 24/7 monitoring. Insurers have seen enough claims caused by phished push approvals to start pricing the difference.
A practical rollout path, not a big-bang project
You don’t need to issue hardware keys to your entire company on day one. A sane order of operations looks like this:
- Start with the accounts that matter most. Prioritize global admins, finance, and anyone with email or remote access privileges. These are the accounts attackers actually target.
- Use what’s already in your employees’ pockets. Passkeys via Windows Hello or a smartphone’s built-in biometric authenticator get you to phishing-resistant MFA with zero new hardware for most users.
- Reserve physical security keys for the accounts that justify them: domain admins, financial controllers, anyone with the ability to move money or change security settings.
- Treat number matching as a bridge, not a destination, if a legacy application can’t support FIDO2 yet.
Moving off SMS and basic push approval isn’t an overnight project, but it’s one of the highest-return security changes a business can make. It closes off the exact method behind some of the most expensive breaches of the last few years, and it increasingly pays for itself in lower insurance premiums.
If you’re not sure which MFA method is actually protecting your accounts today, that’s a five-minute conversation, not a research project. Book Your Free Assessment with Fairway IT Solutions and we’ll tell you exactly where you stand.