Phishing-Resistant MFA: Moving Beyond OTP to FIDO2 and Passkeys

The days of relying on one-time passwords (OTP) and SMS-based authentication are behind us. Phishing-resistant MFA has become essential as threat actors develop sophisticated techniques to compromise traditional authentication methods. Organizations must transition to phishing-resistant MFA solutions like FIDO2 and passkeys to protect sensitive assets, comply with regulatory mandates, and defend against evolving attack vectors. The days of relying on one-time passwords (OTP) and SMS-based authentication are behind us. Phishing-resistant MFA has become essential as threat actors develop sophisticated techniques to compromise traditional authentication methods. Organizations must transition to phishing-resistant MFA solutions like FIDO2 and passkeys to protect sensitive assets, comply with regulatory mandates, and defend against evolving attack vectors.

Why OTP and SMS MFA Are No Longer Enough

One-time passwords and SMS-based MFA were once considered gold-standard security controls. Today, they are outdated and vulnerable. Attackers employ real-time phishing proxies that intercept credentials and MFA codes as users enter them. SIM swap attacks allow threat actors to redirect SMS messages to attacker-controlled devices. Additionally, phishing campaigns targeting enterprise users have become increasingly convincing, with attackers capturing OTP codes in near-real-time before organizations can respond. One-time passwords and SMS-based MFA were once considered gold-standard security controls. Today, they are outdated and vulnerable. Attackers employ real-time phishing proxies that intercept credentials and MFA codes as users enter them. SIM swap attacks allow threat actors to redirect SMS messages to attacker-controlled devices. Additionally, phishing campaigns targeting enterprise users have become increasingly convincing, with attackers capturing OTP codes in near-real-time before organizations can respond.

Push Notification MFA and Fatigue Attacks

Push-based MFA attempts to address OTP weaknesses by sending authentication prompts to trusted devices. However, this approach introduces a new vulnerability: MFA fatigue. Attackers launch sustained push-bombing campaigns—sending dozens of authentication requests until a user becomes fatigued and accepts a malicious prompt. Recent high-profile breaches involving major cloud providers demonstrate that push fatigue remains a critical threat to enterprise security. Push-based MFA attempts to address OTP weaknesses by sending authentication prompts to trusted devices. However, this approach introduces a new vulnerability: MFA fatigue. Attackers launch sustained push-bombing campaigns—sending dozens of authentication requests until a user becomes fatigued and accepts a malicious prompt. Recent high-profile breaches involving major cloud providers demonstrate that push fatigue remains a critical threat to enterprise security.

What Makes Phishing-Resistant MFA Truly Resistant

Phishing-resistant MFA relies on cryptographic binding rather than shared secrets or time-based codes. The FIDO2 standard and WebAuthn protocol use public-key cryptography to bind authentication credentials to specific devices and authentication services. This means: Phishing-resistant MFA relies on cryptographic binding rather than shared secrets or time-based codes. The FIDO2 standard and WebAuthn protocol use public-key cryptography to bind authentication credentials to specific devices and authentication services. This means:

• The credential cannot be used on unauthorized domains—even if a phishing site mimics the legitimate service. The credential cannot be used on unauthorized domains—even if a phishing site mimics the legitimate service.

• Authentication occurs only with explicit user confirmation on the device itself, eliminating fatigue attacks. Authentication occurs only with explicit user confirmation on the device itself, eliminating fatigue attacks.

• No shared secrets are transmitted across the network, preventing interception or replay attacks. No shared secrets are transmitted across the network, preventing interception or replay attacks.

Understanding Passkeys: Device-Bound, User-Friendly Authentication

Passkeys represent the next evolution of phishing-resistant MFA. Built on FIDO2 and WebAuthn, passkeys are cryptographic credentials stored on user devices and unlocked via biometric or PIN authentication. Unlike traditional passwords, passkeys are: Passkeys represent the next evolution of phishing-resistant MFA. Built on FIDO2 and WebAuthn, passkeys are cryptographic credentials stored on user devices and unlocked via biometric or PIN authentication. Unlike traditional passwords, passkeys are:

• Device-bound: passkey credentials never leave the device and are cryptographically linked to the authenticating service. Device-bound: passkey credentials never leave the device and are cryptographically linked to the authenticating service.

• Biometric-secured: users unlock passkeys with fingerprint, face recognition, or PIN—no password to forget or phish. Biometric-secured: users unlock passkeys with fingerprint, face recognition, or PIN—no password to forget or phish.

• Cross-platform: modern passkey ecosystems enable users to authenticate across devices (phones, tablets, laptops) within the same organizational trust boundary. Cross-platform: modern passkey ecosystems enable users to authenticate across devices (phones, tablets, laptops) within the same organizational trust boundary.

Interim Steps: Number-Matching and Context-Aware Prompts

While organizations transition to phishing-resistant MFA, interim security enhancements reduce fatigue attack risk. Number-matching requires users to confirm a displayed number on their authentication device matches the one shown on the login screen—preventing unauthorized approvals. Context-aware prompts display IP geolocation, device fingerprint, and timestamp data, enabling users to reject suspicious requests immediately. While organizations transition to phishing-resistant MFA, interim security enhancements reduce fatigue attack risk. Number-matching requires users to confirm a displayed number on their authentication device matches the one shown on the login screen—preventing unauthorized approvals. Context-aware prompts display IP geolocation, device fingerprint, and timestamp data, enabling users to reject suspicious requests immediately.

Enterprise Rollout: Privileged Users First, Then All Users

Successful phishing-resistant MFA deployment follows a phased approach. Administrators and privileged account holders—who face the highest risk—should adopt FIDO2 and passkey authentication first. This reduces attack surface on high-value targets and demonstrates security benefits to the broader workforce. Once these groups are protected, organizations expand phishing-resistant MFA to all users, supported by employee training and device provisioning programs. Successful phishing-resistant MFA deployment follows a phased approach. Administrators and privileged account holders—who face the highest risk—should adopt FIDO2 and passkey authentication first. This reduces attack surface on high-value targets and demonstrates security benefits to the broader workforce. Once these groups are protected, organizations expand phishing-resistant MFA to all users, supported by employee training and device provisioning programs.

SecurePass by eMudhra: FIDO2-Certified Phishing-Resistant MFA

SecurePass delivers FIDO2-certified, phishing-resistant MFA designed for enterprises requiring strong authentication without complexity. The platform supports passkey authentication, hardware security keys, and risk-based adaptive MFA that adjusts authentication rigor based on login context. SecurePass integrates seamlessly with existing identity infrastructure and supports compliance requirements across regulated industries—from financial services to government and healthcare. SecurePass delivers FIDO2-certified, phishing-resistant MFA designed for enterprises requiring strong authentication without complexity. The platform supports passkey authentication, hardware security keys, and risk-based adaptive MFA that adjusts authentication rigor based on login context. SecurePass integrates seamlessly with existing identity infrastructure and supports compliance requirements across regulated industries—from financial services to government and healthcare.