What is
phishing-resistant MFA?

Anything you can read out or type in, an attacker can also ask you for. A convincing fake login page — or a phone call from someone pretending to be "IT support" — simply asks for the code after your password, and you hand it straight over without realising. The code was genuine; it just went to the wrong place.

There's a related trick called "MFA fatigue": the attacker already has your password and spams those "approve this sign-in" prompts to your phone, over and over, hoping a tired or busy person eventually taps "yes" just to make them stop. And with a fake login page, the attacker can even capture the login session itself — so they stay signed in without needing your password or codes again. (We explain that one in our token theft article.)

• ▸ It's bound to the real website address. It checks that you're on the genuine site and simply refuses to work on a look-alike page — so a fake login can't get anything useful, even if you're fooled.
• ▸ The secret never leaves your device. There's no code to read out, no number to type, and nothing to steal or be tricked into sharing — the proof stays locked inside your phone, laptop or key.

• ▸ Passkeys. You sign in by unlocking with your fingerprint, face or a device PIN — the same gesture you use to open your phone. Nothing to remember, nothing to type.
• ▸ Security keys. A small physical key you plug in or tap against your device to prove it's really you. It lives on your keyring and works only for the real sites.
• ▸ Windows Hello for Business. On a work PC, you sign in with your face or fingerprint instead of a password — quick, and tied to that specific device.

1. Start with your highest-risk accountsEmail, administrator and finance logins are the ones attackers want most, so they're where phishing-resistant MFA pays off first.
2. Roll it out graduallyBring people across in small groups rather than all at once, so no one is disrupted and any hiccups are easy to sort out.
3. Keep a backup method registeredAlways leave a second, trusted way to sign in — like a backup security key — so people don't get locked out if a device is lost or broken.
4. Get help planning itA good IT partner sequences the whole thing so it's smooth, sets sensible defaults, and looks after the people who need a hand.