# mfa-device

Source: https://startwithidentity.com/glossary/mfa-device/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

An MFA device is the physical thing a user has (a phone running an authenticator app, a hardware security key, a smart card, or an OTP token) that supplies the "something you have" factor in [multi-factor authentication](https://startwithidentity.com/glossary/mfa/). [NIST SP 800-63B-4](https://pages.nist.gov/800-63-4/sp800-63b.html) calls these authenticators and classifies them by how they prove possession, not by brand.

| MFA device | NIST 800-63B-4 type | Phishing-resistant? |
|---|---|---|
| Phone receiving an SMS or voice code | Out-of-band device over the PSTN, a "restricted" authenticator | No |
| Phone with a push app, such as [Microsoft Authenticator](https://startwithidentity.com/vendors/mfa/microsoft-authenticator/) or [Duo](https://startwithidentity.com/vendors/mfa/duo/) | Out-of-band device | No, even with [number matching](https://startwithidentity.com/glossary/number-matching/) |
| Phone or token showing a 6-digit [TOTP](https://startwithidentity.com/glossary/totp/) code | Single-factor OTP | No |
| Hardware security key, such as a [YubiKey](https://startwithidentity.com/vendors/mfa/yubico/) | Single- or multi-factor cryptographic authenticator ([FIDO2](https://startwithidentity.com/glossary/fido2/)) | Yes |
| Phone or laptop holding a [passkey](https://startwithidentity.com/glossary/passkey/) | Multi-factor cryptographic authenticator | Yes |
| PIV or CAC smart card | Multi-factor cryptographic authenticator | Yes |

The distinction that matters is the last column. A device that displays or receives a code the user types can be relayed by a phishing proxy; a device that signs a challenge bound to the website's origin cannot. NIST SP 800-63B-4 requires that verifiers "SHALL offer at least one phishing-resistant authentication option at AAL2", and it bars syncable authenticators, such as synced passkeys, at AAL3 because their keys can be exported.

When choosing MFA devices, plan for loss as carefully as for issuance: register at least two devices per user, decide how a lost device is replaced (a [Temporary Access Pass](https://startwithidentity.com/glossary/temporary-access-pass/) after re-verification, not an SMS code), and remove the old device from the account.

See also: [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/), [phishable MFA](https://startwithidentity.com/glossary/phishable-mfa/), [AAL](https://startwithidentity.com/glossary/aal/), [MFA matrix](https://startwithidentity.com/tools/mfa-matrix/), [best MFA solutions](https://startwithidentity.com/rankings/best-mfa-solutions/), [MFA implementation best practices](https://startwithidentity.com/guides/authentication/mfa-implementation-best-practices/)