Explainer · Authentication & MFA
Glossary
Phishing-resistant MFA
Authentication a fake site can't relay.
Definition
Phishing-resistant MFA is authentication that a fake website or man-in-the-middle cannot capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and security keys are the common examples. SMS codes and authenticator-app codes are not phishing-resistant.
Related terms
- PasskeyA login credential bound to one website.
- FIDO2Open standard behind passkeys and security keys.
- OTP botAutomated calls that trick victims into reading out codes.