# phishing-resistant-mfa

Source: https://startwithidentity.com/glossary/phishing-resistant-mfa/
Last updated: 2026-10-17
License: content by Start with Identity. Cite the source URL.

---

Multi-factor methods that cannot be relayed or replayed by a phishing site, principally FIDO2 security keys and passkeys. Recommended by NIST and CISA over OTP and push.

The property that makes a method phishing-resistant is origin binding: the authenticator refuses to produce a signature for a domain other than the one that registered the credential, so an [adversary-in-the-middle](https://startwithidentity.com/glossary/adversary-in-the-middle/) proxy gets nothing usable. Everything a human can read, type, or approve can be relayed, which is why one-time codes and push approvals are not in this category regardless of how they are marketed.

See also: [WebAuthn and FIDO2](https://startwithidentity.com/standards/webauthn-fido2/), [passkey](https://startwithidentity.com/glossary/passkey/), [AAL](https://startwithidentity.com/glossary/aal/), [MFA vendors](https://startwithidentity.com/vendors/mfa/), [browser-in-the-browser](https://startwithidentity.com/glossary/browser-in-the-browser/), [MFA fatigue](https://startwithidentity.com/glossary/mfa-fatigue/)