# phishable-mfa

Source: https://startwithidentity.com/glossary/phishable-mfa/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

Phishable MFA is any multi-factor method whose output a user can be tricked into handing to an attacker's site, which then replays it to the real one: SMS and voice codes, authenticator app codes (TOTP), email codes and push approvals, with or without number matching. NIST [SP 800-63B-4](https://pages.nist.gov/800-63-4/sp800-63b.html) draws the line precisely: authenticators "that involve the manual entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be considered phishing-resistant because the manual entry does not bind the authenticator output to the specific session being authenticated".

The distinction matters because phishable MFA still stops password-only attacks but not [adversary-in-the-middle](https://startwithidentity.com/glossary/adversary-in-the-middle/) proxies or a convincing phone call. SWI's [Identity Breach Report 2026](https://startwithidentity.com/reports/identity-breach-report-2026/) found MFA bypassed in 25 of the 40 breaches where MFA status was known, and the [Phishing-Resistant MFA Support Matrix 2026](https://startwithidentity.com/reports/phishing-resistant-mfa-matrix-2026/) found that 21 of 95 business SaaS apps (22.1%) document only phishable local MFA. US federal policy ([OMB M-22-09](https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf)) requires phishing-resistant methods for agency staff. The way out is [passkeys](https://startwithidentity.com/glossary/passkey/) or FIDO2 security keys enforced at the identity provider, plus [SSO enforcement](https://startwithidentity.com/glossary/sso-enforcement/) so the phishable fallback cannot be chosen.

See also: [phishing-resistant MFA](https://startwithidentity.com/glossary/phishing-resistant-mfa/), [number matching](https://startwithidentity.com/glossary/number-matching/), [AitM phishing proxy](https://startwithidentity.com/techniques/aitm-phishing-proxy/), [OTP relay social engineering](https://startwithidentity.com/techniques/otp-relay-social-engineering/), [MFA matrix](https://startwithidentity.com/tools/mfa-matrix/), [WebAuthn / FIDO2](https://startwithidentity.com/standards/webauthn-fido2/)