Any MFA beats no MFA, but not every method is equally safe.

INFOGRAPHIC
Each MFA method resists phishing differently
SMS / phone call
Exposed to SIM swap and code phishing
Authenticator app (TOTP)
Users can still be tricked into typing codes on fake sites
Push notification
Vulnerable to repeated prompts (MFA fatigue)
Passkey / FIDO2
Bound to the real domain, so the most phishing-resistant
← Weaker phishing resistanceMost phishing-resistant →

How each MFA method differs (weakest to strongest phishing resistance)

  • SMS / phone call: easy to use, but exposed to SIM swapping and code-phishing
  • Authenticator app (TOTP): safer than SMS, but attackers can still trick users into typing codes on fake sites
  • Push notification: convenient, but vulnerable to repeated prompts until a user approves (MFA fatigue)
  • Passkey / FIDO2 security key: bound to the real domain, so the most phishing-resistant

Which MFA should you choose?

Admins and executives should use passkeys or security keys first. Everyone else should move away from SMS where alternatives exist. MFA is one foundation of Zero Trust and one of the first steps to prevent ransomware.

Phishing-resistant MFA helps a lot, but it cannot help if a deepfake voice talks an employee into reading out a code. See Deepfake Social Engineering: How Organizations Respond for the human side of the defense.

MFA is only one part of identity work. If you are unsure how IAM, IGA, PAM, and CIEM differ and which to start with, read IAM vs IGA vs PAM vs CIEM.

To see how passkeys work and how synced and device-bound types differ, read Passkeys and FIDO2 Explained: Beyond Passwords.

References and further reading