iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Businesses should make phishing-resistant multifactor authentication (MFA) the target state, using FIDO/WebAuthn security keys or passkeys wherever their identity service and devices support them. SMS codes should be retained only as a last-resort fallback while stronger enrollment and account-recovery methods are being established.
Start with administrator accounts, email, remote access, file storage, privileged systems, and staff who handle sensitive data. The recommendation follows the Cybersecurity and Infrastructure Security Agency (CISA), which tells businesses to use the strongest available MFA option and says they should aim for a phishing-resistant method.
The short answer: choose phishing-resistant MFA
MFA still improves security compared with a password alone, but the second factor determines how much protection an attacker gets. CISA’s small-business guidance says, “Businesses should aim to use a phishing-resistant MFA method.” CISA’s MFA guidance also recommends enabling MFA broadly and selecting the strongest option available.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFor most organizations, the practical target is FIDO/WebAuthn authentication with a hardware security key or passkey. These methods bind the sign-in to the legitimate website or application, so a fake login page cannot simply collect the response and replay it. If a business cannot deploy that method immediately, an authenticator app or number-matched push can serve as an interim control. SMS or voice codes belong at the bottom of the hierarchy because the code can be phished, relayed in real time, intercepted through telecommunications attacks, or obtained after a phone number is taken over.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What makes MFA phishing-resistant?
In a phishing attack, the criminal directs a user to an impostor sign-in page. Passwords and one-time codes entered there can be forwarded to the real service while the victim is still on the page. A phishing-resistant authenticator instead verifies the relying party’s origin as part of the cryptographic exchange. The response is therefore bound to the real service rather than being a reusable string that a criminal can copy.
CISA’s January 2023 fact sheet identifies FIDO/WebAuthn and public-key-infrastructure (PKI) authentication as phishing-resistant. A hardware security key is a physical implementation of FIDO authentication. Passkeys are another acceptable option; CISA’s December 2024 mobile communications guidance recognizes them as an alternative for supported services and devices.
Security keys and passkeys
A security key stores cryptographic credentials in dedicated hardware and requires a user action such as touching the key or entering a PIN. A passkey uses the same general public-key model but is stored on a supported phone, computer, or password manager and unlocked with the device’s local PIN or biometric. Both can resist a conventional look-alike sign-in site when the identity provider implements FIDO/WebAuthn correctly.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →The security property does not remove every operational issue. A company still needs enrollment, spare authenticators, replacement procedures, device coverage, and a controlled recovery path. Those lifecycle decisions determine whether a phishing-resistant deployment remains usable during travel, device loss, employee departure, or an outage.
Why SMS codes are materially weaker
With SMS MFA, the service sends a one-time code to a phone number and the user types it into a sign-in form. CISA describes this as a “text or email code” in its small-business guidance. The code is still a secret that can be entered into an impostor page and relayed to the real service before it expires.
CISA’s fact sheet also identifies exposure to SS7 attacks and SIM-swap attacks for SMS and voice methods. SS7 is the signaling system used by telecommunications networks; abuse or provider-level access can allow messages to be redirected or read. In a SIM swap, a criminal persuades a carrier to move the victim’s number to a SIM under the criminal’s control. CISA’s mobile guidance adds that SMS messages are not encrypted and may be read by a threat actor who gains access to a telecommunications provider’s network.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
These are not reasons to leave accounts at password-only security. They are reasons to treat SMS as a temporary or emergency option and to remove it when a stronger method and a safe recovery process are available. CISA puts the point plainly: “While better than having no additional security layer, Short Message Service (SMS) should be an organization’s last resort for implementing multifactor authentication.” The statement appears in CISA’s four-goal cybersecurity guidance.
How the main MFA choices compare
| Method | Phishing resistance | Other exposure identified by CISA | Appropriate business role |
|---|---|---|---|
| FIDO/WebAuthn security key or passkey | Phishing-resistant | Push bombing, SS7, and SIM-swap attacks do not apply to this method category in CISA’s comparison | Preferred target where the identity service, applications, and devices support it |
| Authenticator-app or token OTP | Vulnerable to phishing because a code entered on a form can be captured and replayed | SS7 and SIM-swap attacks do not apply to app/token OTP in CISA’s table | Interim control when phishing-resistant MFA cannot be deployed immediately |
| Push with number matching | Still categorized by CISA as vulnerable to phishing, although it resists push-bombing attacks | SS7 and SIM-swap attacks do not apply to the app-based method in CISA’s table | Better interim choice than push without number matching; do not describe it as phishing-resistant |
| SMS or voice code | Vulnerable to phishing | Exposed to SS7 and SIM-swap attacks | Last resort when stronger options are unavailable; remove as a fallback where the service permits |
The classifications and exposure comparisons in this table come from CISA’s Implementing Phishing-Resistant MFA fact sheet. “Phishing-resistant” is a specific security property, not a synonym for “has MFA.”
Where to apply stronger MFA first
A staged deployment reduces risk sooner than waiting for every application to support the final method. Prioritize access that can expose many accounts or large amounts of data:
- Administrator, superuser, and other privileged accounts.
- Corporate email, because it is commonly used to reset other passwords and approve transactions.
- Remote-access gateways, virtual private network (VPN) services, and administrative consoles.
- File storage, collaboration systems, source-code repositories, and systems containing sensitive personal or financial data.
- Employees whose roles handle sensitive data, manage infrastructure, or approve payments.
CISA’s business guidance specifically recommends starting with administrators and employees handling sensitive data, then applying MFA to email, file storage, remote access, and privileged access. A business can extend the same policy to contractors and other users after testing the enrollment and support process.
A practical rollout plan
1. Inventory identity and recovery paths
List every identity provider, cloud application, remote-access service, administrator portal, and local system that accepts employee credentials. Record which systems support FIDO2 or WebAuthn, passkeys, app OTP, number-matched push, SMS, or only passwords. Include unmanaged devices, shared workstations, mobile users, and contractors.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteMap how each account is recovered. A service that offers FIDO at normal sign-in may still send an SMS during password reset or device replacement. That weaker recovery route can undermine the protection of the primary authenticator. CISA warns in its mobile guidance that some services retain SMS in recovery even after an authenticator app is enabled.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
2. Pilot the strongest supported method
Choose a small group of administrators and representative users. Enroll a security key or passkey, test sign-in from managed and approved personal devices, and verify browser, operating-system, mobile, and remote-access compatibility. Test the exact applications employees use rather than assuming that support in the identity provider covers every connected service.
Include failure cases in the pilot: a lost phone, a missing key, an unavailable network, a replacement device, and a help-desk request from a user who cannot authenticate. Record the time and evidence required for identity verification before scaling the rollout.
3. Give critical accounts more than one strong authenticator
Where the identity platform supports it, enroll two independent phishing-resistant authenticators for each critical administrator. A primary key can remain with the employee while a spare is stored under the organization’s control. For passkeys, document which devices or password managers hold the credential and how a replacement is authorized.
This is an operational safeguard rather than a universal CISA-prescribed key lifecycle. The objective is to avoid a forced downgrade to SMS when one device is lost or damaged.
4. Define controlled recovery and break-glass access
Write a recovery procedure before enforcing the new method. Require help-desk staff to verify identity using information that is not available from the locked account alone. Log every authenticator reset, require an appropriate second approver for privileged users, and alert security staff when a recovery occurs.
Maintain a tightly restricted break-glass account only when the service requires one. Keep its credentials offline or in an approved vault, limit who can use it, test it periodically, and review every use. Do not make a shared SMS number the permanent emergency path for administrators.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
5. Remove weaker fallbacks after testing
After users have successfully enrolled and recovery works, disable SMS as a sign-in and recovery option wherever the service allows it. Do not assume that adding a security key automatically removes SMS. If a provider cannot disable the weaker route, document the residual exposure, restrict who can initiate recovery, and protect the recovery channel separately.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Using interim methods without confusing their limits
Some applications, devices, or legacy connectors will not support FIDO/WebAuthn immediately. Use an authenticator-app or token OTP, or push with number matching, as a migration step rather than the final policy. CISA’s Identity and Access Management best-practices document and its phishing-resistant MFA fact sheet identify these as stronger interim choices than SMS in the relevant circumstances.
Train users that an OTP is still a secret and must never be entered into an unexpected page or read to a caller. Number matching reduces approval spam, but it does not make a phishable code or approval cryptographically bound to the legitimate site. Keep a migration register showing which groups and applications remain on interim methods, the reason, and the date for reassessment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Compatibility, purchasing, and administration checks
The category “FIDO security key” does not identify one universally compatible product. Before purchasing, verify support for the organization’s identity provider, browser, operating systems, mobile devices, USB or wireless interfaces, certificate requirements, and each major application. Check whether the service supports multiple keys, passkeys, administrative enforcement, audit logs, and recovery without SMS.
Test enrollment for ordinary users as well as administrators. A key that works in a desktop browser may not work in a mobile workflow, virtual desktop, command-line tool, or third-party connector. Confirm that employees can use the authenticator while traveling and that a lost or damaged device can be replaced without bypassing the policy.
CISA names hardware-based FIDO keys as an example of phishing-resistant MFA, but its guidance does not provide a current model-by-model compatibility matrix. Select hardware only after the identity-platform and device tests above, and avoid claiming that any one model works everywhere.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Policy checklist for a business MFA standard
- Require MFA for all externally reachable business systems, with phishing-resistant methods preferred.
- Set a separate target date for privileged accounts and high-value applications.
- Classify FIDO/WebAuthn security keys and passkeys as the target method; classify app OTP and number-matched push as interim controls.
- Classify SMS and voice codes as last-resort methods, with an owner and deadline for removal.
- Review password-reset, device-replacement, and help-desk recovery paths for weaker factors.
- Issue or approve spare authenticators for critical roles and document custody.
- Log enrollment, reset, replacement, break-glass, and fallback events.
- Train users to reject unexpected sign-in prompts and never disclose one-time codes.
- Reassess applications and connectors that cannot yet support the target method.
- Tailor legal and regulatory requirements to the organization’s industry and jurisdiction; the CISA material cited here is U.S. guidance, not a universal compliance rule.
Common implementation mistakes
Calling every MFA method phishing-resistant
“MFA enabled” describes a control category, not its resistance to phishing. Use the method names and limitations in the comparison table in policy documents and user training.
Leaving SMS enabled because enrollment succeeded
An attacker may choose the weakest available recovery or fallback route. Review every alternate factor after rollout and disable SMS when the provider permits.
Buying keys before testing applications
Compatibility depends on the identity service, connected applications, device types, browsers, and recovery features. Pilot the real sign-in journeys first.
Deploying without a recovery plan
Users who lose their only authenticator will pressure support staff for an exception. Multiple strong authenticators, verified recovery, and audited break-glass access prevent that pressure from turning into an SMS downgrade.
Decision framework
- If FIDO/WebAuthn or passkeys are supported: make that the required method for administrators and high-impact applications, then expand to the workforce.
- If the target method is not yet supported: deploy app/token OTP or number-matched push, document the limitation, and schedule migration.
- If only SMS or voice is available: enable it rather than relying on passwords alone, restrict it to the affected service, and treat it as a last-resort exception.
- Before removing SMS: test enrollment, replacement, recovery, and break-glass procedures; then disable the weaker path wherever technically possible.
This approach follows CISA’s central instruction to use the strongest MFA option available while recognizing that business systems rarely move to a single method at the same time.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
