Phishing-resistant MFA

Phishing-resistant MFA is authentication that a user cannot be tricked into completing for an attacker, because the proof is cryptographically bound to the legitimate site's origin rather than typed by a human. Passkeys and FIDO2 security keys qualify; SMS codes, app-generated codes, and push approvals do not, since each can be relayed or socially engineered in real time.

The phrase appears with regulatory force: PCI DSS 4.0 and multiple US federal directives now require phishing resistance for specific access classes, which turns the definition into a compliance boundary rather than a preference.

The boundary the term draws is about who or what completes the proof. Anything a human can be talked into performing, reading a code aloud, approving a prompt, typing digits into a page, can be relayed by an attacker operating in real time between the user and the real site. Origin binding removes the human from that loop: the browser refuses to produce a proof for the wrong origin, and there is nothing for the user to get wrong.

Because the phrase now appears in requirements rather than recommendations, the compliance reading is narrower than the marketing one. A vendor describing a push prompt with number matching as phishing-resistant is describing a real improvement over a plain prompt, and it is not the property the requirements name. Checking the definition against the specific control being claimed is the whole exercise.

The residual exposure after a phishing-resistant factor is deployed is the enrollment and recovery path, since both exist to work when the strong factor is unavailable. An account with a passkey and a phone-based reset has an SMS-strength floor, and raising that floor is a separate project from deploying the credential.

Reading the requirement against the specific control, rather than against a vendor's summary of it, is what keeps the claim defensible in an audit.

Where a phone-based factor remains in the recovery path, the state of the line behind it is the control that keeps it meaningful, which is what SIM swap detection supplies.