iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Multifactor authentication (MFA) makes an account harder to access with a stolen password alone, but it does not prove who someone is in every real-world sense or guarantee that an account is safe. It verifies control of one or more authenticators associated with an account. The protection depends on the method used, the devices and channels involved, and the account’s recovery and session controls.
What does MFA actually verify?
Authentication checks whether a claimant controls one or more authenticators linked to an account. A password plus a code, for example, is evidence that the claimant knows the password and can access the channel or device that produced the code. It is not, by itself, proof of a person’s broader identity in every context.
The “identity trap” is treating the label “MFA enabled” as a complete security verdict. MFA is a valuable control, but different methods provide different protections, and the account lifecycle around login matters too. NIST’s SP 800-63B-4, finalized July 31, 2025, describes authentication and assurance requirements; it does not make every MFA implementation equivalent.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Can hackers bypass MFA?
Yes, some attacks can defeat or work around particular MFA methods. That does not make MFA useless: it raises the barrier for an attacker who has only stolen a password. The practical question is which method is enabled and whether the attacker can target its user, device, network, recovery path, or an already authenticated session.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Phishing and relaying: A fake sign-in page can capture a password and a manually entered one-time code, then relay them to the legitimate service. NIST says manually entered OTP and out-of-band outputs are not phishing-resistant because they are not bound to the specific session being authenticated.
- Push fatigue: Repeated approval prompts can pressure or confuse someone into approving a request they did not initiate. NIST recommends that out-of-band authentication transfer an authentication secret rather than rely on a simple approval.
- Phone-network attacks: CISA warns that SIM-swap attacks and weaknesses involving SS7 signaling can affect some MFA methods that rely on phone networks.
- Compromised devices or recovery paths: Malware, an exposed authenticator, manipulated account-recovery details, or an unauthorized authenticator added to the account can undermine protection. MFA does not secure a device or make recovery procedures trustworthy by itself.
- Existing sessions: Login is only one point in an account’s lifecycle. NIST’s assurance guidance addresses session reauthentication timeouts, and an existing session may remain relevant even when a new login would require MFA.
CISA calls MFA an essential practice because it makes access more difficult when credentials are compromised, while also warning that some methods are vulnerable to phishing, push bombing, SS7 exploitation, or SIM swapping. Its phishing-resistant MFA fact sheet is dated October 2022.
Is two-factor authentication really secure?
Two-factor authentication (2FA) is a form of MFA that uses two factors. It is generally more protective than relying on a password alone, but “two factors” does not automatically mean “phishing-resistant.” For example, a password plus a code that a person types into a look-alike site can still be exposed to a relay attack.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The more useful distinction is whether the authentication protocol binds the proof to the legitimate verifier or protected channel. NIST defines phishing resistance as preventing authentication secrets or valid outputs from being disclosed to an impostor verifier without relying on the claimant’s vigilance. A method that depends on a person noticing a deceptive page provides a different level of protection from one that cryptographically binds authentication to the genuine service.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How common MFA methods differ
| Method | Phishing resistance | Important trade-off |
|---|---|---|
| Manually entered SMS or app one-time code | Not phishing-resistant under NIST’s definition; the entered output is not bound to the specific session. | Codes can be captured and relayed. Phone-network methods also face risks such as SIM swapping and SS7-related weaknesses. |
| Push approval | A simple approval prompt is not the phishing-resistant verifier binding described by NIST. | Repeated or unexpected prompts can lead to accidental approval; deny requests you did not initiate. |
| Security key or platform authenticator using WebAuthn/FIDO2 | WebAuthn provides verifier-name binding, a phishing-resistant property identified by NIST. | The service and device must support the method. Keep a secure alternate authenticator and understand recovery before relying on a single device or key. |
This is a comparison of protocol properties and known risks, not a universal ranking of every service’s implementation. NIST identifies WebAuthn, used by FIDO2 authenticators, as an example of verifier-name binding: the authenticator selects a secret based on the verifier’s authenticated domain name. A compatible security key is a physical second factor, but support varies by account and device; check both before choosing one. The FTC explains two-factor authentication and security keys for consumers.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What is phishing-resistant MFA?
Phishing-resistant MFA uses an authentication protocol that binds the proof to the genuine verifier or protected channel, so a look-alike site cannot simply collect a valid response and reuse it at the real service. NIST names WebAuthn as an example of verifier-name binding.
NIST’s SP 800-63B-4 says that authenticators involving manual entry of an output, including OTP and out-of-band authenticators, “SHALL NOT be considered phishing-resistant” because the output is not bound to the specific session. A security key or platform authenticator can provide stronger phishing resistance when it uses a supported protocol such as WebAuthn; the label alone does not guarantee compatibility or protection in every configuration.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should you choose and protect?
- Enable MFA on high-impact accounts. Prioritize email, financial accounts, and services that can reset passwords or provide access to other accounts. CISA also lists social media, online stores, gaming, and streaming accounts among useful candidates.
- Choose a phishing-resistant option when available. Check that both the account and your devices support it. If using a physical security key, confirm the service’s requirements and set up a secure alternate method where possible.
- Do not approve unexpected prompts. If you did not start the sign-in, deny the request. Treat repeated requests as a possible attack and secure the account through the provider’s official process.
- Protect the whole account lifecycle. Keep devices and authenticators secure, review recovery contact details, and understand how to report a lost or compromised authenticator. NIST recommends maintaining an alternate authenticator to support loss or compromise reporting.
What do NIST’s MFA requirements mean for ordinary accounts?
NIST’s AAL2 requirements apply to systems that claim that assurance level; they require the verifier to offer a phishing-resistant option. Separately, federal agencies must require phishing-resistant authentication for staff, contractors, and partners accessing federal information systems. These are standards and federal-system requirements—not a universal mandate that every consumer service must offer or require phishing-resistant MFA.
What should you do if your account is hacked even with MFA?
Use the provider’s official recovery process promptly. The FTC’s account-recovery guidance recommends changing the password, signing out of other devices, enabling 2FA if it is available, and checking recovery contact information. If an authenticator may be compromised, report it to the provider and have it invalidated; NIST directs credential service providers to suspend, invalidate, or destroy compromised authenticators promptly after compromise is detected.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Change the account password to a strong, unique one.
- Use the service’s option to sign out of other devices or sessions.
- Review recovery email addresses and phone numbers and remove any you do not recognize.
- Enable MFA if it was not already enabled, preferably using a phishing-resistant option the service supports.
- Report a lost or compromised authenticator and follow the provider’s recovery steps to remove or replace it.
See the FTC’s steps to take after an account or other scam-related compromise and its guidance for recovering hacked email or social media accounts.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
