In this guide · 7 sections
Short answer
Phishing-resistant MFA is sign-in that is cryptographically tied to the real website, so a fake page cannot reuse it. Passkeys, FIDO2 security keys and certificate-based authentication qualify. SMS codes, authenticator app codes and push approvals can be relayed by phishing kits, so they do not.
What phishing-resistant MFA means
Multi-factor authentication (MFA) asks for something beyond a password. Most MFA methods give the user a code or a prompt and trust them to use it on the right website. That is the weakness: if the user is on a convincing fake page, they hand over the code too.
Phishing-resistant methods remove the user's judgement from the equation. The Cyber Security Agency of Singapore's advisory Understanding Passwordless Authentication (AD-2026-011), published 26 August 2026 and updated 18 September 2026, defines it like this: if a user is directed to a fake website, the sign-in cannot be completed because the credential is cryptographically bound to the legitimate service or cannot be replayed.
In practice, a passkey or security key checks the website's real address before it answers. On a lookalike domain it simply does not work, however convincing the page looks.
How adversary-in-the-middle phishing beats normal MFA
Adversary-in-the-middle (AiTM) phishing kits are sold as a service and need little skill to run. The flow usually looks like this:
A lure email or message
A fake invoice, shared document, voicemail or delivery notice links to a page that looks like the Microsoft 365 or Google sign-in.
The kit proxies the real sign-in page
The page is a live relay. Everything the victim types goes to the real Microsoft or Google site, and the real responses come back.
Password and code are relayed
The victim enters their password and SMS or app code. The kit passes both on within seconds, so the code is still valid.
The session cookie is stolen
After sign-in succeeds, the kit keeps the session cookie. The attacker can now use the mailbox without needing MFA again until the session ends.
Mailbox rules and fraud follow
Attackers typically add inbox rules to hide replies, then send fake payment requests from the real account.
CSA's advisory names this risk directly: even with one-time codes, adversary-in-the-middle attacks can trick users into providing their passwords and authentication codes. Push approvals have a related weakness; our guide to MFA fatigue and push bombing explains it.
Which MFA methods are phishing-resistant
This table follows CSA's AD-2026-011 classification. Authenticator app codes are not listed separately by CSA, but they work like SMS codes in an AiTM attack, because the code can be typed into a fake page and relayed.
| Method | Phishing-resistant? | Why |
|---|---|---|
| Passkeys (FIDO2/WebAuthn) | Yes | Bound to the real website with public-key cryptography |
| FIDO2 security keys (USB, NFC) | Yes | Same standard; key must be physically present |
| Certificate-based authentication | Yes | Private key stays on the smart card or managed device |
| Push approval in an app | No | Users may be tricked into approving fraudulent requests |
| SMS one-time password | No | Codes can be entered on phishing sites; SIM swap risk |
| Authenticator app code (TOTP) | No (our assessment) | A typed code can be relayed like an SMS code |
| Magic links by email | No | The link can be intercepted or used if a user is deceived |
The FIDO Alliance explains how passkeys work across phones, computers and password managers. Any MFA is still far better than none; phishing-resistant MFA is the next step up.
Passkeys vs security keys: which to choose
Passkeys on phones and laptops
Most staff- Unlocked with fingerprint, face or device PIN
- Can sync across a user's devices or a password manager
- No extra hardware to buy
- Supported by Microsoft Entra ID and Google Workspace
Best for: Everyday staff accounts.
FIDO2 security keys
Admins- A small USB or NFC device on a keyring
- Credential never leaves the key
- Must be physically present to sign in
- Buy two per admin: one in use, one in a safe
Best for: Global admins, finance approvers and shared-device users.
Microsoft's passkey set-up guide says Entra ID supports synced passkeys and device-bound passkeys on FIDO2 security keys and in Microsoft Authenticator. Google's passkey admin article lets admins allow staff to skip the password and sign in with a passkey on a phone, security key or computer screen lock. Our passkeys set-up guide gives the full admin steps for both.
A rollout plan: admins first
You do not have to switch everyone at once. Protect the accounts that would hurt most first.
Admins: security keys or passkeys only
Give each Global Admin or super admin two FIDO2 keys or a passkey, then require phishing-resistant sign-in for admin roles.
Finance and directors next
Anyone who approves payments or changes bank details is the main target of invoice fraud. Move them to passkeys.
Everyone else, with a deadline
Ask staff to register a passkey on their phone or laptop within a set window, with a short guide and a help slot.
Enforce it in policy
In Microsoft Entra, Conditional Access can require the built-in Phishing-resistant MFA authentication strength. In Google Workspace, 2-Step Verification enforcement includes an 'Only security key' option for groups.
Plan for lost devices
Decide how a staff member who loses their phone gets back in, such as a spare key or a Temporary Access Pass in Entra, so the helpdesk is not the weak link.
Microsoft's authentication strengths article lists the built-in Phishing-resistant MFA strength as allowing Windows Hello for Business or a platform credential, FIDO2 security keys and Entra certificate-based authentication. Conditional Access needs Entra ID P1, which Microsoft says Business Premium customers can use; see our Conditional Access guide. Google documents the enforcement options in its 2-Step Verification deployment guide.
Do it yourself or get help?
If you have not turned on MFA at all yet, start with our guide to setting up MFA for business accounts, then come back to this rollout. A small team on Microsoft 365 Business Premium or Google Workspace can move admins to security keys in an afternoon.
Our Microsoft 365 / Google Security Lockdown (S$590) sets up MFA and passkeys, admin protection, Conditional Access or 2SV enforcement and safe recovery options, and checks that weaker fallbacks are switched off.
Frequently asked questions
It is a sign-in method that cannot be used on a fake website, because it checks the site's real address with cryptography before it answers. Passkeys, FIDO2 security keys and certificate-based sign-in work this way. Codes and push approvals rely on the user spotting the fake page, which is why phishing kits can steal them.
No. A six-digit code from an authenticator app can be typed into a phishing page and relayed to the real site within its validity window, just like an SMS code. Authenticator apps are still better than SMS because they avoid SIM swap attacks, but they do not stop adversary-in-the-middle phishing.
There is no general law requiring it for SMEs. CSA's August 2026 advisory recommends passwordless, phishing-resistant methods such as passkeys, and explains why SMS codes and push approvals are weaker. Some sectors, customers and insurers may set their own requirements, so check contracts and policies that apply to you.
Usually not. Passkeys stored on phones, laptops or password managers are phishing-resistant and cost nothing extra. Security keys make most sense for admins, finance approvers and people who use shared devices. Buy two per person who gets them, so a lost key does not lock them out.
It is much harder, but not impossible. Attackers may target weaker fallback methods, trick the helpdesk into resetting an account, or use malware on a device that already has a session. Remove SMS fallbacks, verify identity before resets, and keep devices patched and protected.