Multi-Factor Auth: Which Types Resist Phishing

Choose MFA by attack resistance: SMS is better than password-only, authenticator codes are stronger, and passkeys or security keys best resist phishing.

Multi-factor authentication is not one technology. SMS codes, authenticator-app codes, push approvals, hardware security keys, and passkeys all add a second step, but they resist different attacks. For high-value accounts such as email, banking, password managers, tax services, and admin consoles, prefer phishing-resistant methods when the service supports them. Security keys and passkeys are designed so a fake website cannot simply collect a code and replay it. TOTP authenticator codes are a meaningful improvement over password-only access. SMS is still better than no second factor, but phone-number takeover and real-time phishing make it a weaker choice for accounts that can use stronger methods.

Start with the accounts that can reset everything else

Protect your primary email, password manager, mobile carrier, Apple/Google/Microsoft identity, financial accounts, and work administrator accounts first. An attacker who controls email can often reset downstream passwords; an attacker who controls the carrier can intercept SMS; an attacker who controls the password manager can access many unique credentials. MFA priority should therefore follow account leverage, not the order in which apps happen to appear on your phone.

Before changing factors, verify recovery. Add a second passkey, backup security key, or safe recovery method where possible. Store recovery codes outside the account itself. Strong authentication that strands you after losing one phone is not operationally strong.

SMS is a floor, not a ceiling

Do not disable SMS on an account if doing so would leave you with password-only access. Instead, move upward when alternatives exist. Add an authenticator app or passkey, test it, then remove SMS as a sign-in factor if the provider allows and if your recovery plan remains sound. Some banks still require SMS for certain actions, so focus on what you can control rather than pretending every account has identical options.

Harden the carrier account separately with a port-out PIN, number lock, or equivalent protection. This reduces one of SMS MFA’s major risks but does not make SMS phishing-resistant.

TOTP codes are strong against password reuse but not against live phishing

A time-based one-time password changes every few seconds and is not sent through the mobile carrier. That removes SIM swap from the authentication path. However, a fake website can ask you for the current code and immediately relay it to the real site. The defense is partly behavioral: use a password manager that recognizes the correct domain, avoid sign-in links in unexpected messages, and prefer passkeys or security keys where the account supports them.

Keep the authenticator’s recovery or transfer method secure. If every TOTP seed is backed up to the same compromised cloud account, the independence of the second factor is reduced.

Push notifications require discipline against fatigue attacks

Push MFA can be convenient, but attackers sometimes trigger repeated prompts until a user approves one just to make the noise stop. Never approve a prompt you did not initiate. Number matching and additional context can make push stronger because you must match the sign-in session instead of tapping a generic “Approve.” If unexpected prompts begin, change the password and investigate the source rather than continuing to decline indefinitely.

Passkeys and security keys change the phishing equation

A phishing-resistant authenticator verifies the website origin as part of authentication. If you land on a convincing look-alike domain, the passkey or security key should not authenticate to the wrong origin. That removes the “type this six-digit code into the fake page” failure mode. It does not protect you from malware already controlling your device or from a weak customer-support recovery process, so endpoint security and account recovery still matter.

For families or small teams, enroll at least two trusted authenticators on critical accounts. Label physical keys and store the spare separately. For shared business accounts, prefer individual identities with MFA over one shared password and one person’s phone.

Backup codes are credentials, not memorabilia

Recovery codes often bypass the second factor. Treat them like passwords. Store them in a secure vault or offline location, not in a screenshot album synchronized to every device. Remove old codes if the provider regenerates a new set. During account-takeover recovery, generate fresh backup codes because an attacker who previously accessed the account may have copied the old ones.

Do not measure MFA success by how many accounts show a green checkmark

The meaningful question is whether your highest-value accounts resist the attacks you actually face and whether you can recover them safely. A passkey on a low-value forum matters less than strong MFA on the email account that controls your bank resets. Review the stack annually or after a lost phone, SIM swap, breach, or major device change. Strong MFA is an architecture around recovery paths, not a one-time settings exercise.