Security Guides

#security basics #MFA #password management #phishing #AI-era readiness

Choosing MFA the right way: what 'phishing-resistant' means, and why SMS is weak

SMS, authenticator apps, and passkeys differ in how strong they are as MFA. Why SMS falls to phishing and SIM-swap, what 'phishing-resistant' really means, and which factor to put on which account.

Published 2026-06-12 Updated 2026-10-18 15 min read

On this page

MFA combines two or more different categories of authentication factors. 2FA uses two categories; two-step verification describes the number of checks and is not automatically MFA.

This site's view: judge MFA by its method, not by whether it is on

For important accounts, review the actual method, user verification and recovery options, rather than recording only that MFA is on. A phishing-resistant login can still coexist with a weaker recovery path. This is our defensive recommendation, not a claim about what causes most takeovers.

Why you need MFA

A password should be treated as "going to leak eventually" on its own. Reuse, breach dumps, guessing and phishing are all ways a password gets broken. MFA adds a second factor so that a broken password alone still doesn't let someone log in.

password

assume it leaks eventually

+1 factor

a second factor blocks entry with a leaked password alone

3 tiers

the method changes what it can block

a taken-over inbox can reset every other account

The email account matters most of all. Many services recover "forgot password" by email, so the moment your email is taken, other accounts get reset one after another. That's why email is the account to guard with the strongest MFA (→ Tier 0 of the baseline checklist).

How strength differs by method

Even called "two-factor," the methods differ enormously in strength. Left is weak, right is strong. The dividing line is "can it be presented to a fake site?"

✗ SMS / email

codes can be phished; SMS also faces phone-number takeover

△ authenticator (TOTP)

stronger than SMS, but the code can be relayed to a fake site

○ passkey

domain-bound signature; PIN or biometrics when user verification is required

◎ security key

a FIDO2 hardware key; strongest; keep a spare

Left is weak, right is strong. The dividing line: can it be handed to a fake site? Passkeys/keys cannot, by design.

SMS / email codes

the code is just digits — it can be pasted into a fake site
SIM swapping targets SMS or voice delivery to a phone number. Email codes instead depend on the mailbox and its recovery protections; both types of manually entered code can be phished.
relay phishing forwards the code to the real site, and it can't stop that
better than nothing, but not enough on its own for important accounts

Passkey / security key (FIDO2)

the key is bound to the destination domain — no signature on a fake site
phishing-resistant by design (doesn't rely on human judgment)
For a passkey or security key used on its own as MFA, the service must require and verify user verification such as a PIN or biometrics. A security key can also be combined with a password; touch alone is not a second factor.
use this for your email, domain, and payment accounts

What "phishing-resistant" actually means

This is the key concept. With SMS or an authenticator code, in the end a human has to judge with their eyes whether they're entering it on the right site — but people can't tell a perfect look-alike domain apart. A passkey or security key (FIDO2), by contrast, knows which domain it is for, so it returns no signature to a fake site. In other words, even if the human is fooled, the key won't sign for the fake site. That's "phishing resistance," and it's the decisive difference between weak and strong methods.

Comparison table (including push notifications)

This comparison follows CISA's October 2022 material; it is not a complete assessment of every service. Besides SMS, authenticator apps and passkeys, settings pages often offer one more method: tap "Yes" on a notification sent to your phone (push notification). The US Cybersecurity and Infrastructure Security Agency (CISA) ranks MFA from strongest to weakest like this:

Method	Entered on a fake site	Repeated prompts until you tap	SIM-swap	Position (CISA)
Passkey / security key (FIDO2)	no signature is produced	not applicable	not applicable	strongest (phishing-resistant)
Authenticator app code (TOTP)	can be relayed	not applicable	not applicable	second tier
Push notification with number matching	can be relayed	unlikely	not applicable	second tier
Push notification (approve button only)	can be relayed	possible	not applicable	third tier
SMS or voice code	can be relayed	not applicable	possible	last resort

The weak spot of push notifications is this: once an attacker has the password, they send approval prompts again and again until the user taps "Approve" by mistake or just to make them stop. CISA calls this "push bombing" (MFA fatigue). The fix is number matching: you can't approve until you type the number shown on the sign-in screen into the app. For Microsoft work and school accounts (Microsoft Entra ID), number matching has been required for every Microsoft Authenticator push notification since May 8, 2023.

The manual-code and ordinary push methods in this table are not phishing-resistant. FIDO is not the only possible resistant technology: NIST also describes client-authenticated TLS. This guide focuses on passkeys and FIDO2 keys commonly offered to consumers; CISA recommends app codes or number-matching push as interim options.

By situation: which method to choose

You don't need the same method on every account. Sort them by how much damage a takeover would do.

Account or situation	Recommended method	Backup to set up
Personal email (Gmail, Outlook.com, etc.)	passkey	a passkey on a second device, or backup codes
Password manager	passkey or security key	a second security key, plus recovery details kept on paper
Domain, server or cloud admin	security keys (two)	the second key stored elsewhere, recovery codes
Banking and brokerage	the passkey or other method the firm provides	the firm's own reset procedure
Social media, online shopping	passkey, otherwise an authenticator app	backup codes
A family member without a smartphone	security keys (two), SMS if those can't be used	backup codes kept by the family

When in doubt, ask "is this account used to recover other accounts?" Email and your password manager are the way into everything else, so those two get the strongest method.

How to set it up (order matters)

Start with email, domain, and payments

Put phishing-resistant MFA (passkey/security key) on email, domain registrar, server panel, and payment accounts first, because these can be used to reset your other accounts (→ the baseline checklist).

MFA on the password manager itself

The password manager holding your daily logins is itself one of your most important accounts. Double it up with a master password plus MFA (→ storing passwords safely).

If unsupported, use an authenticator (TOTP)

On services without passkey support, choose an authenticator app, not SMS. Keep SMS as the last resort when nothing else is offered.

Store recovery codes safely

Losing the only usable authenticator can prevent sign-in if no supported recovery option remains. Keep recovery codes in a secure note in your password manager or an encrypted store, separately from the device.

Have one backup factor

Keep a backup that meets the service's requirements. Two registered hardware keys are useful; Apple Account requires at least two. Losing one key need not lock you out if another registered key, trusted device, or supported recovery method remains available.

Even with MFA, stop reusing passwords

MFA is insurance, not an excuse for weak passwords. On services where only non-phishing-resistant MFA (like SMS) is available, the strength and uniqueness of the password is still your main protection. Gauge it with the password strength checker.

Where to set it up on major services

Here is where to start (per the official help pages as of October 2026; screen names can change).

Service	Where to find it	Methods and notes
Google Account	Google Account → "Security & sign-in" → "2-Step Verification"	passkeys, security keys, Google prompts, authenticator app, SMS or voice, backup codes
Microsoft account (personal)	account.microsoft.com/security → "Manage how I sign in" → "Additional security" → "Two-step verification"	you can also remove the password and sign in without one
Apple Account	Settings → [your name] → "Sign-In & Security" → "Two-Factor Authentication" → "Security Keys"	you must add at least two FIDO Certified keys (iOS 16.3 or later); once added, the key replaces the six-digit verification code
GitHub	Settings → "Password and authentication"	steps in how to set up GitHub 2FA

On any service, once you register the first method, set up the backup method and save the backup codes on the same day. If you put it off, it won't be there when you lose the device.

Choosing an authenticator app or a security key

What to check in an authenticator app

whether you can move the codes to a new phone when you switch devices
Google Authenticator has offered optional sync to your Google Account since April 2023
keeping codes in your password manager is convenient, but if that is breached, both factors leak from the same place
for important accounts, keep codes in an app separate from your passwords

What to check in a security key

choose a product that supports FIDO2 (FIDO Certified)
check it fits your devices' ports (USB-A, USB-C) or NFC for phones
buy two from the start and register both on the same account
carry one and keep the other somewhere else, such as at home

How to check your own setup

Run Google's Security Checkup

At myaccount.google.com/security-checkup you can see your 2-Step Verification methods, recovery phone and email, and signed-in devices in one place. Remove any old phone number you find.

Review your Microsoft account's sign-in methods

Under "Manage how I sign in" at account.microsoft.com/security, check the list of registered methods. Delete phone numbers and email addresses you no longer use.

On iPhone, check trusted numbers and keys

In Settings → [your name] → "Sign-In & Security," check which phone numbers receive verification codes and which security keys are registered.

List the method for each account

For email, password manager, domain, cloud, banking and brokerage, and social media, note "current method," "backup method," and "where the backup codes are kept" in a secure note in your password manager. If an important account has only SMS, switch that one first.

Actually sign in with the backup

Try signing in once with the passkey on your second device or with your second security key. "Registered but didn't work" is a failure you only discover by testing.

Common mistakes and how to fix them

Adding a passkey but leaving SMS able to sign in or reset the account: remove SMS where the service allows it; where it doesn't, confirm the registered number is still yours.
Tapping an approval prompt you didn't expect: always deny prompts that arrive when you aren't signing in, then change that account's password.
Keeping backup codes as a photo or screenshot on your phone: lose the phone and you lose them too. Store them in your password manager or on paper somewhere else.
A spare key or another supported recovery method may be needed.
Wiping the old phone first when switching devices: confirm your authenticator app and passkeys work on the new phone before you wipe the old one.
Reading out a code when someone asks by phone or message: even if they claim to be the service or your own help desk, never give the code to anyone.

A real case: a code handed over

DentaQuest, which runs dental and vision benefits in the US, filed notices with state attorneys general about unauthorized access in May 2026. According to the filing, the entry point was one employee who was deceived through social engineering into providing credentials and a multi-factor authentication code. In its August 3 updated filing, the company said it had identified more than 27.4 million people nationwide. The filing does not say what type of MFA was in use.

What this case shows is that a code a person can read out or type in can be handed over when that person is deceived. For anyone running accounts, the response has two parts:

move important accounts to methods that can't be handed over, such as passkeys and security keys
have the help desk verify the caller's identity before resetting anyone's authentication methods

The full timeline and what members should do are in the DentaQuest data breach.

What this site does itself

This site locks down its important accounts (especially email, domains, server admin, and payments) with phishing-resistant MFA wherever possible. The reason is simple: if one of these is taken over, the other accounts can be taken over with it. Daily logins live in a password manager, and the manager itself carries MFA.

And we don't stop at "MFA is on" — we periodically review which method is in place. When we find an important account with only SMS, we treat that as a weak spot and prioritize upgrading it to a passkey/security key. Manage by strength, not by presence — that's our policy.

Sources

NIST SP 800-63-4 / SP 800-63B-4 — NIST: authentication factors / NIST: phishing resistance
FIDO Alliance — Passkeys FAQ: user verification
CISA, "Implementing Phishing-Resistant MFA" (October 2022) — cisa.gov (PDF) (MFA forms ranked strongest to weakest, push bombing, SIM-swap)
CISA, "Implementing Number Matching in MFA Applications" (October 2022) — cisa.gov (PDF)
Microsoft Learn, "How number matching works in MFA push notifications for Authenticator" — learn.microsoft.com
Google Account Help, "Turn on 2-Step Verification" — support.google.com
Microsoft Support, "How to use two-step verification with your Microsoft account" — support.microsoft.com
Apple Support, "About Security Keys for Apple Account" — support.apple.com
Google Security Blog, "Google Authenticator now supports Google Account synchronization" (April 24, 2023) — security.googleblog.com
DentaQuest filings with the Washington State Attorney General (July 16, 2026, updated August 3) — atg.wa.gov

FAQ

QIf I turn on MFA, am I safe?

MFA reduces risk, but the method and recovery process matter. SMS codes face phone-number takeover as well as phishing; email codes depend on the security of the mailbox. For important accounts, prefer a phishing-resistant method and check its user-verification and recovery conditions.

QWhy is SMS called weak?

Because the code is just a string of digits, and a human has to judge whether the place they're entering it is real or fake. Relay phishing (you type the code into a perfect look-alike) and SIM-swap (your phone number is hijacked) defeat it. It's better than nothing, but not enough on its own for important accounts.

QWhich method should I actually pick?

MFA uses different factor categories. Manually entered codes can be relayed through phishing; SMS also depends on control of the phone number. Prefer phishing-resistant methods such as passkeys or FIDO2 security keys for important accounts, check user-verification requirements, and protect recovery methods too. For a passkey or security key used on its own as MFA, the service must require and verify user verification such as a PIN or biometrics. A security key can also be combined with a password; touch alone is not a second factor.

QIs tapping 'Approve' on a phone notification safe?

It's stronger than SMS, but an attacker who knows your password can send approval prompts over and over until you tap one by mistake (push bombing). Number matching, where you type the number from the sign-in screen into the app, makes this much harder. Always deny a prompt that arrives when you aren't signing in, and change that account's password.

QCan I keep authenticator codes in my password manager?

It's convenient and safer than SMS. But if the password manager is breached, both the password and the code leak from the same place. For important accounts such as email, domains and payments, use a passkey or security key, or an authenticator app kept separate from your passwords.

QHow many security keys do I need?