No. 07Week of September 23, 2026This week’s briefing
Tradecraft

Buyer’s guide

Phishing-resistant MFA: a buyer’s guide

What makes an authenticator phishing-resistant, which kinds qualify, and how to evaluate products for customers and for your own workforce.

By Reviewed by [REVIEWER NAME]Published 3 min read

For CISOs IAM engineers Security engineers

Commercial-intent guideEditorial, not sponsoredNo scores, ratings or rankingsOwner interest disclosedMethodology

The short answer

What counts as phishing-resistant MFA?

Phishing-resistant MFA is authentication that a fake site or man-in-the-middle can’t capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and hardware security keys are the common examples, and CISA also counts PKI-based smart cards. SMS codes, authenticator-app codes and simple push approvals are not phishing-resistant.

If you read nothing else

  1. Phishing resistance comes from binding the credential to the real site, not from adding another code.
  2. Synced passkeys are accepted at AAL2; hardware-bound keys are the AAL3 option.
  3. Workforce and customer deployments need different evaluation criteria.
  4. We explain categories and criteria; we don’t score products.

What “phishing-resistant” actually means

An authenticator is phishing-resistant when a fake website or a man-in-the-middle can’t capture what the user provides and replay it. That comes from cryptography: the credential is bound to the real site, so the browser or device will only use it there. CISA’s guidance names FIDO/WebAuthn and PKI-based authentication as the phishing-resistant forms of MFA.[1] SMS codes, authenticator-app codes and simple push approvals don’t qualify, because a user can be persuaded to hand over or approve them.

The approaches

Tradecraft summary of CISA [1], NIST [2] and FIDO Alliance [3][4] guidance.
ApproachWhere it fitsNIST 800-63B-4Main trade-off
Synced passkeysCustomers; most workforce usersAllowed at AAL2Security of the sync account
Device-bound passkeys and security keysAdministrators; high-risk staffEligible for AAL3Lost-device recovery; hardware logistics
PKI-based smart cardsGovernment and regulated workforces[EDITORIAL: confirm AAL mapping]Card issuance and reader infrastructure

Synced passkeys

Backed up across the user’s devices by a platform or password manager, synced passkeys fix the biggest usability problem of device-bound credentials, losing the device. NIST 800-63-4 accepts them at AAL2.[2][3] The trade-off is that the sync account becomes part of the attack surface.

Device-bound passkeys and security keys

The private key never leaves the hardware it was created on. That is why hardware-bound keys remain the option for AAL3 use cases and for administrators.[2] The cost is logistics: issuing, replacing and recovering physical keys.

PKI-based smart cards

Certificate-based credentials, such as the US government’s PIV cards, are phishing-resistant under CISA’s guidance.[1] They suit organizations that already run the card and certificate infrastructure.

How to evaluate

Tradecraft’s evaluation criteria. See the methodology.
CriterionWhy it mattersHow to test it
Standards conformanceInteroperability and a defensible position with auditorsAsk for FIDO certification status and WebAuthn support
Assurance levelDifferent flows need AAL2 or AAL3Map each flow to the level it must meet
RecoveryWhere passkey deployments get attackedWalk through a lost-device scenario end to end
FallbacksA phishable fallback undoes phishing resistanceAsk which methods remain available and when
Lifecycle managementEnrollment, revocation and replacement at scaleAsk to see the admin workflow
Attestation and policy controlsLets you require device-bound keys where neededAsk how you restrict which authenticators are accepted
AccessibilityEvery user needs a usable optionTest with assistive technologies

Questions to ask every vendor

  1. Which FIDO certifications do your products hold, and for which versions?
  2. How do you support synced and device-bound passkeys side by side?
  3. Can we require device-bound credentials for specific users or roles?
  4. What are the recovery options, and do any of them fall back to a phishable method?
  5. How do enrollment and revocation work for thousands of users?
  6. What does the end user see on each supported platform?
  7. What data do you store about users and their devices?

Vendor landscape

Vendors are listed by approach in alphabetical order. We don’t publish scores, ratings or rankings.

Landscape not yet populated. [EDITORIAL: populate from the inclusion criteria.]
ApproachVendors (alphabetical)
Passkey and FIDO2 platforms[VENDOR], [VENDOR], [VENDOR]
Hardware security keys[VENDOR], [VENDOR], [VENDOR]
Smart card and PKI[VENDOR], [VENDOR]

Questions readers ask

Are push notifications phishing-resistant?

Simple push approvals are not, because a user can be persuaded to approve a request they didn’t start. CISA’s guidance does not count them as phishing-resistant.

Are synced passkeys phishing-resistant?

Yes. They are bound to the site they were created for. NIST 800-63-4 accepts them at AAL2.

Is an authenticator app phishing-resistant?

No. Its codes can be typed into a phishing site or read out to a caller.

Sources

  1. CISA Implementing Phishing-Resistant MFA (fact sheet) (2022-10)
  2. NIST SP 800-63B-4: Authentication and Authenticator Management
  3. FIDO Alliance NIST cites phishing resistance of synced passkeys in digital identity guidelines update
  4. FIDO Alliance Passkeys

Changelog

  • : First edition. Vendor landscape not yet populated. Awaiting editorial verification.

Cite this

Tradecraft. “Phishing-resistant MFA: a buyer’s guide.” Tradecraft, September 24, 2026. https://glide-tradecraft.pages.dev/buyers-guides/phishing-resistant-mfa/

Read next

Field guide

Rolling out passkeys to retail banking customers

Decide which passkeys you accept for which customers, offer enrollment right after a strong sign-in, make passkeys the default for returning users, and design account recovery that doesn’t fall back to an SMS code. Keep a non-SMS alternative for customers who can’t use passkeys, and a device-bound option for staff and other high-risk users.

Explainer

Are synced passkeys phishing-resistant?

Yes. A passkey is bound to the website it was created for, so it can’t be entered on a look-alike site. NIST’s 800-63-4 update accepts synced passkeys at AAL2. The main new risk is the account that syncs them, which needs strong protection of its own.

Field guide

Preparing for NIST SP 800-63-4: a working plan for banks and agencies

Map every authenticator you use to NIST’s assurance levels, identify the restricted ones (SMS and voice codes), and for each restricted authenticator document a risk assessment, user notice, a non-restricted alternative and a migration plan. Add a phishing-resistant option such as passkeys, which Revision 4 accepts at AAL2.

Take the checklist

Terms in this piece