Phishing-resistant authentication is now the baseline for identity

At a glance

What this is: OneSpan argues that phishing-resistant authentication, especially passkeys and FIDO credentials, is becoming the default response to phishing proxies, real-time interception, and social engineering against traditional MFA.

Why it matters: IAM teams need to treat phishing resistance as a core authentication requirement, not an optional upgrade, because the attack methods bypassing MFA are now routine rather than edge cases.

By the numbers:

• Phishing attacks increased by 4.2% after the introduction of ChatGPT, according to OneSpan.

Context

Phishing-resistant authentication is the ability to verify a user or device without exposing reusable secrets that an attacker can intercept and replay. That matters because modern phishing no longer depends on stolen passwords alone; it increasingly uses real-time relay, adversary-in-the-middle flows, and social engineering that defeat conventional MFA assumptions, especially in human IAM programmes.

OneSpan’s recap of the FIDO Alliance seminar frames this shift as a baseline change in identity design, not a niche hardening exercise. For practitioners, the issue is whether authentication policy still assumes that MFA alone is enough, or whether the programme now has to default to cryptographically bound credentials that cannot be phished in transit.

Key questions

Q: How should security teams stop reverse proxy phishing from bypassing MFA?

A: Use controls that inspect the session path, not just the credential outcome. Reverse proxy phishing can relay a valid MFA response in real time, so successful login is no longer a reliable trust signal. Teams should combine session integrity checks, risk-based step-up, and device and browser consistency analysis to separate legitimate sign-ins from mediated ones.

Q: Why do passkeys reduce account takeover risk more effectively than OTP?

A: Passkeys reduce takeover risk because they rely on public-key cryptography rather than shared secrets that can be phished or intercepted. OTP still depends on a code that travels through a vulnerable channel, while passkeys prove possession of a private key without revealing it. That removes the easiest path for credential replay and code theft.

Q: How should IAM teams decide which users need hardware-backed FIDO credentials?

A: Use the strongest authenticators for roles where a compromised session would create high business or administrative impact, including privileged workforce accounts and sensitive transaction flows. Lower-risk users may adopt syncable passkeys first, but high-assurance roles need stronger binding and stricter recovery controls.

Q: What are the best practices for phasing out traditional MFA in a large identity programme?

A: Start by classifying access by risk, then migrate the highest-impact journeys first, including admins, support staff, and users handling sensitive transactions. At the same time, harden recovery, reduce fallback exposure, and measure adoption by segment so the programme does not simply replace one weak factor with another.

Technical breakdown

Why traditional MFA is failing against real-time phishing

Traditional MFA often relies on a shared secret, a one-time code, or an approval step that can still be intercepted, relayed, or socially engineered in real time. Phishing proxies and adversary-in-the-middle attacks capture the authentication moment and forward it to the legitimate service fast enough to satisfy the flow while the attacker rides the session. That is why the security property of MFA is not equivalent to phishing resistance. The problem is not only credential theft, but the ability to weaponise the authentication ceremony itself.

Practical implication: treat phishing resistance as a distinct requirement, not as a synonym for multi-factor authentication.

How passkeys change the authentication trust model

Passkeys use public key cryptography so the relying party verifies a signed challenge rather than a reusable secret. In practical terms, the private key stays bound to the device or a trusted sync model, which removes the interceptable factor that phishers depend on. This shifts authentication from something the user can disclose to something the user can only prove possession of through a legitimate device or platform gesture. For identity teams, that means the trust boundary moves from knowledge and codes to cryptographic binding and device assurance.

Practical implication: evaluate whether your authentication stack can eliminate shared secrets for high-risk user populations.

Why hardware-backed FIDO credentials still matter

Syncable passkeys improve usability and adoption, but hardware-backed FIDO credentials remain the higher-assurance option when the threat model includes targeted phishing, tampering, or stronger user verification needs. The distinction is not convenience versus security, but assurance level versus deployment flexibility. In higher-risk environments, the authentication method must withstand not just password capture but also transaction interception and account takeover attempts that exploit weaker recovery or shared-device patterns. That is where device-bound, hardware-backed credentials keep their value.

Practical implication: reserve the strongest authenticators for privileged and high-impact access paths where phishing would create the most damage.

Threat narrative

Attacker objective: The attacker wants to obtain authenticated access that looks legitimate to the target service, allowing account takeover without needing the original credential.

1. Entry occurs when the attacker uses a phishing proxy, adversary-in-the-middle relay, or social engineering lure to capture the authentication exchange in real time.
2. Credential abuse follows when the attacker replays the session or token flow quickly enough to satisfy the target service while avoiding obvious login failures.
3. Impact lands as account takeover, session hijacking, or fraudulent access that conventional MFA failed to stop because the authentication ceremony itself was compromised.

Breaches seen in the wild

• CoPhish OAuth phishing via Copilot Studio: Datadog showed Copilot Studio agents on a Microsoft domain can front OAuth consent phishing and forward stolen tokens; no victims reported.
• Mailchimp breach 2022: Attackers socially engineered Mailchimp staff, used a support tool to export 102 customer lists and exposed customer API keys for phishing.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing resistance has become a baseline control expectation, not an advanced option. Once attackers can relay authentication in real time, the old assumption that MFA meaningfully blocks account takeover no longer holds. That changes the identity programme from factor-counting to interception resistance. Practitioners should stop treating phishing resistance as a premium feature and start treating it as the minimum standard for high-value access.

Passkeys shift the control point from user memory to cryptographic proof. That is why they matter: they remove the reusable secret that phishing infrastructure depends on. The architectural implication is broader than password replacement, because identity assurance now depends on device binding, challenge signing, and recovery design. Teams that still centre policy on passwords and codes are protecting the wrong failure mode.

Phishing-resistant authentication is also a human identity usability issue. Secure controls fail when users cannot complete access quickly and consistently, which is why the strongest methods also need better UX than legacy MFA. The trade-off is no longer security versus convenience. The programme question is whether the secure path is now the easiest path, because adoption will follow that path.

AI amplification makes the authentication problem more operational, not less. Generative AI lowers the cost and scale of convincing lures, which means identity teams face more frequent attempts against the same weak points. That pushes authentication policy into continuous threat adaptation rather than one-time hardening. Practitioners should re-evaluate recovery flows, help desk enrollment, and fallback methods as part of the same phishing surface.

Passkeys expose a broader governance gap around authentication assurance levels. Many programmes still collapse all MFA into one control bucket, even though the actual resistance to interception varies sharply by method. The implication is that IAM governance has to classify authenticators by attack resilience, not just by whether they satisfy a policy checkbox. Teams should align assurance levels to business risk and privileged access.

From our research library:

• The IBM/Ponemon 2025 Cost of a Data Breach Report found that phishing-initiated breaches cost an average of $4.8M each.

What this signals

Phishing-resistant authentication creates an assurance hierarchy that many identity programmes still lack. Teams need a way to distinguish between MFA that can be relayed and authentication methods that cannot, because policy language often treats them as equivalent. The practical shift is to make phishing resistance a tiered control decision tied to business impact, not a branding choice.

Passkeys should be treated as an operating model change, not a login feature. Once authentication becomes cryptographically bound to a device or platform gesture, recovery design, help desk processes, and enrollment governance become part of the control surface. Programmes that only modernise the front door and ignore fallback paths will leave the easiest path for attackers untouched.

For practitioners

• Prioritise phishing-resistant authentication for high-risk access Move privileged workforce, admin, and sensitive customer journeys to passkeys or hardware-backed FIDO authenticators where interception risk is highest.
• Separate MFA from phishing resistance in policy Rewrite authentication standards so acceptable methods are ranked by interception resistance, not grouped under a single MFA label.
• Tighten recovery and fallback paths Review help desk resets, account recovery, and backup factors because attackers often bypass strong login methods through weak fallback controls.
• Map authenticator strength to access tier Use stronger authenticators for privileged and high-impact access, and reserve lower-assurance methods only for low-risk scenarios.
• Track adoption and failure rates by user segment Measure sign-in success, help desk volume, and enrollment friction separately for workforce, customer, and privileged populations.

Key takeaways

• Phishing-resistant authentication is now a baseline requirement because real-time phishing methods can defeat conventional MFA.
• Passkeys and hardware-backed FIDO credentials reduce interception risk by replacing reusable secrets with cryptographic proof.
• The real governance test is whether recovery, fallback, and assurance levels are aligned to the access risk being protected.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• Adversary-in-the-middle Attack: An adversary-in-the-middle attack intercepts and relays authentication in real time between the user and the legitimate service. It is especially dangerous for OTPs because the attacker can capture the code while it is still valid and immediately use it to complete login.
• Authenticator assurance level: Authenticator assurance level is a measure of how strongly an identity event proves the claimant is genuine. In NIST 800-63B, higher levels require stronger factor evidence and tighter cryptographic protections, which makes the level a practical way to map identity controls to regulated access requirements.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.