MFA Device
An MFA device is the physical thing a user has (a phone running an authenticator app, a hardware security key, a smart card, or an OTP token) that supplies the "something you have" factor in multi-factor authentication. NIST SP 800-63B-4 calls these authenticators and classifies them by how they prove possession, not by brand.
| MFA device | NIST 800-63B-4 type | Phishing-resistant? |
|---|---|---|
| Phone receiving an SMS or voice code | Out-of-band device over the PSTN, a "restricted" authenticator | No |
| Phone with a push app, such as Microsoft Authenticator or Duo | Out-of-band device | No, even with number matching |
| Phone or token showing a 6-digit TOTP code | Single-factor OTP | No |
| Hardware security key, such as a YubiKey | Single- or multi-factor cryptographic authenticator (FIDO2) | Yes |
| Phone or laptop holding a passkey | Multi-factor cryptographic authenticator | Yes |
| PIV or CAC smart card | Multi-factor cryptographic authenticator | Yes |
The distinction that matters is the last column. A device that displays or receives a code the user types can be relayed by a phishing proxy; a device that signs a challenge bound to the website's origin cannot. NIST SP 800-63B-4 requires that verifiers "SHALL offer at least one phishing-resistant authentication option at AAL2", and it bars syncable authenticators, such as synced passkeys, at AAL3 because their keys can be exported.
When choosing MFA devices, plan for loss as carefully as for issuance: register at least two devices per user, decide how a lost device is replaced (a Temporary Access Pass after re-verification, not an SMS code), and remove the old device from the account.
See also: phishing-resistant MFA, phishable MFA, AAL, MFA matrix, best MFA solutions, MFA implementation best practices
Related on Start with Identity
- GlossaryBiometric Authentication
Biometric authentication confirms a person by comparing a live measurement of a physical characteristic, such as a fingerprint or face, against a template captu
- GlossarySynced Passkey
A synced passkey is a passkey that a passkey provider, such as a platform keychain or password manager, copies across the user's devices through a cloud service
- GlossaryMFA Fatigue
MFA fatigue, also called push bombing, is an attack in which someone who already has a user's password triggers push approval prompts over and over until the us
- Blog46.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and i
- ReportPhishing-Resistant MFA Support Matrix 2026
54% of 95 business SaaS apps support passkeys or security keys, but only 13% let admins require them, and 60% of apps with a documented SSO plan charge more for
- BlogThe SMS off-ramp has a date now: what Entra, GOV.UK and America.gov mean for your MFA plan
Microsoft stops delivering SMS and voice codes in Entra ID on February 1, 2027. The UK has opened passkeys to more than 23 million GOV.UK One Login users, and t