Identity guide

What Is Multi-Factor Authentication? Methods Compared

Multi-factor authentication (MFA) asks for two or more different kinds of proof before a login succeeds: something you know (a password), something you have (a phone or key) or something you are (a biometric). It stops most attacks that start with a stolen password. But the methods are not equal. CISA ranks phishing-resistant MFA, meaning FIDO/WebAuthn and PKI-based authentication, strongest, and SMS or voice codes weakest.

Below: the methods compared, what NIST SP 800-63B-4 says about assurance levels and phishing resistance, and how to roll MFA out. Last reviewed 3 November 2026. General information, not legal advice; US guidance is used as the reference.

Updated 3 November 2026

MFA methods compared

The order below follows CISA's ranking from strongest to weakest, based on susceptibility to phishing, push bombing, SS7 exploitation and SIM swap attacks.

Method	Phishing-resistant?	Weak points (per CISA)
FIDO/WebAuthn (security keys, passkeys) and PKI-based (smart cards)	Yes	Resistant to phishing. Push bombing, SS7 and SIM swap are not applicable.
App OTP, token OTP, or push with number matching	No	Vulnerable to phishing. Resistant to push bombing. SS7 and SIM swap are not applicable.
Push notification without number matching	No	Vulnerable to push bombing and user error.
SMS or voice codes	No	Vulnerable to phishing, SS7 and SIM swap. Last-resort option.

CISA also notes that app-based OTP, push with number matching and token-based OTP are the best options for small and medium-size businesses that cannot immediately implement phishing-resistant MFA. The fact sheet is from October 2022; the ranking logic still holds, but check CISA for newer guidance.

Phishing-resistant versus not

A typed code can be relayed. If a lookalike site collects your password and your 6-digit code, the attacker can replay both to the real site in seconds. CISA uses exactly this example. Phishing-resistant methods avoid it because the credential is bound to the real site: NIST describes this as verifier name binding for WebAuthn/FIDO2, where the credential is tied to the authenticated domain name, and channel binding for client-authenticated TLS such as PIV smart cards. A fake site cannot obtain a usable response.

NIST SP 800-63B-4 states that passwords, look-up secrets, out-of-band methods and OTPs are not considered phishing-resistant, because manual entry does not bind the output to the session. The W3C published Web Authentication Level 3 as a Recommendation on 25 August 2026, the browser standard behind passkeys and security keys.

What NIST SP 800-63B-4 says

NIST SP 800-63B-4 was published in July 2025 and supersedes SP 800-63B of March 2020. It sets requirements for US federal systems but is widely used as a reference. It defines three authentication assurance levels (AAL).

Level	What it requires
AAL1	Single-factor or multi-factor authentication. Verifiers should offer multi-factor options.
AAL2	Proof of two distinct factors, with at least one replay-resistant authenticator. Verifiers must offer at least one phishing-resistant option, and federal agencies must require phishing-resistant authentication for their staff, contractors and partners.
AAL3	Proof of possession of a key using a public-key protocol, from a phishing-resistant cryptographic authenticator with a non-exportable private key, plus two distinct factors.

SMS and voice are restricted. Out-of-band authentication over the telephone network must meet NIST's restricted-authenticator requirements, and alternatives must be available. Email is prohibited for out-of-band authentication.
Syncable authenticators (the kind that copy the key to other devices, as many passkeys do) are addressed in a normative appendix and are not permitted at AAL3, because AAL3 needs a non-exportable key.
Passwords: a password used alone must be at least 15 characters; one used only as part of MFA may be shorter but at least 8. NIST says not to impose composition rules or require periodic changes unless there is evidence of compromise. See the password policy lab.

Compliance note: PCI DSS v4.0.1

The PCI Security Standards Council published PCI DSS v4.0.1 in June 2024. For Requirement 8 it added an applicability note that MFA for all non-administrative access into the cardholder data environment does not apply to user accounts that are authenticated only with phishing-resistant authentication factors, and it added a definition of phishing-resistant authentication. Details and other regimes are mapped in the phishing-resistant MFA planner and the PCI DSS compliance guide.

How to roll out MFA

Start with the highest-value accounts. Administrators, email, remote access and anything that can change money or permissions.
Pick the strongest method each group can use. Security keys or passkeys for administrators and high-risk staff; the hardware token chooser compares the options.
Turn on number matching for any push-based method you keep, and limit repeated prompts.
Retire SMS where you can, and treat it as a fallback only. Protect account recovery, which attackers target next.
Plan the lost-device case with a second registered authenticator and a verified recovery process.
Test it. Practise the attacks in the MFA bypass lab and the design calls in the passkey lab. For a code-generation demo, see the TOTP generator.

Frequently asked questions

What is multi-factor authentication (MFA)?

CISA describes MFA as a security control that requires a user to present a combination of two or more different authenticators to verify their identity for login: something you know, something you have, or something you are. If one factor, such as a password, is compromised, an attacker still cannot sign in without the second.

Is 2FA the same as MFA?

Two-factor authentication (2FA) is MFA with exactly two factors. In practice the terms are used interchangeably. What matters more than the count is the type of second factor, because some are far easier to phish or hijack than others.

What does phishing-resistant MFA mean?

NIST SP 800-63B-4 defines phishing resistance as the ability of an authentication protocol to prevent disclosure of authentication secrets to an impostor verifier without relying on the claimant’s vigilance. It names two mechanisms: channel binding, such as client-authenticated TLS used by smart cards, and verifier name binding, such as WebAuthn/FIDO2, which ties the credential to the authenticated domain name. Typed codes do not qualify.

Is SMS MFA safe?

It is better than no MFA but is the weakest common option. CISA ranks SMS or voice codes last, as vulnerable to phishing, SS7 exploitation and SIM swap attacks, and says it should be a last-resort option. NIST SP 800-63B-4 treats out-of-band authentication over the public switched telephone network, including SMS and voice, as a restricted authenticator.

Are authenticator app codes phishing-resistant?

No. App-based one-time passwords are stronger than SMS but are still vulnerable to phishing: CISA’s own example is a lookalike login page that collects the password and the 6-digit code together. NIST says one-time passwords are not phishing-resistant because manual entry does not bind the output to the session.

What is push bombing, and does number matching stop it?

Push bombing, also called push fatigue, is when an attacker repeatedly triggers push prompts until the user taps Accept. CISA lists push with number matching, where the user must enter numbers shown by the login page, as resistant to push bombing, though still vulnerable to phishing. Plain push without number matching is vulnerable to push bombing.

Are passkeys MFA?

Passkeys are built on the WebAuthn standard. The W3C specification describes multi-device credentials, commonly referred to as synced passkeys, as a way to provide phishing-resistant sign-in, with the device asking for a previously configured authorization gesture such as a PIN or biometric. CISA lists FIDO/WebAuthn as phishing-resistant MFA. Whether one passkey sign-in counts as two factors depends on the policy you apply. See the plain-language passkey guide linked below.

Can attackers bypass MFA?

Yes, in the cases above: phishing pages that relay codes, push fatigue, SS7 and SIM swap against phone-based codes. CISA says any form of MFA is better than none, but phishing-resistant MFA is the gold standard and organizations should make migrating to it a high priority.