Phishable MFA
Phishable MFA is any multi-factor method whose output a user can be tricked into handing to an attacker's site, which then replays it to the real one: SMS and voice codes, authenticator app codes (TOTP), email codes and push approvals, with or without number matching. NIST SP 800-63B-4 draws the line precisely: authenticators "that involve the manual entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be considered phishing-resistant because the manual entry does not bind the authenticator output to the specific session being authenticated".
The distinction matters because phishable MFA still stops password-only attacks but not adversary-in-the-middle proxies or a convincing phone call. SWI's Identity Breach Report 2026 found MFA bypassed in 25 of the 40 breaches where MFA status was known, and the Phishing-Resistant MFA Support Matrix 2026 found that 21 of 95 business SaaS apps (22.1%) document only phishable local MFA. US federal policy (OMB M-22-09) requires phishing-resistant methods for agency staff. The way out is passkeys or FIDO2 security keys enforced at the identity provider, plus SSO enforcement so the phishable fallback cannot be chosen.
See also: phishing-resistant MFA, number matching, AitM phishing proxy, OTP relay social engineering, MFA matrix, WebAuthn / FIDO2
Related on Start with Identity
- GlossaryTwo-Factor Authentication (2FA)
Two-factor authentication (2FA) is sign-in that requires two distinct types of authentication factor, typically a password (something you know) plus a phone, co
- GlossaryAuthentication Policy
An authentication policy is an identity provider rule that decides which authentication methods a user must satisfy to reach a given application, based on condi
- GlossaryLocal Login Bypass
A local login bypass is any way into an SSO-protected application that does not go through the identity provider: an owner or admin account that keeps a passwor
- Blog46.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and i
- BlogAttackers are phoning employees about their passkeys, then enrolling their own MFA method
Microsoft detailed a campaign running since May 2026 in which callers posing as IT tell US enterprise users to update their passkey or MFA settings, route them
- RankingBest Phishing-Resistant MFA: Top 5 Providers
The best phishing-resistant MFA providers in 2026: Yubico, HYPR, Beyond Identity, Duo, and 1Kosmos. Ranked for FIDO2, passkeys, and phishing-resistant workforce