Phishing-resistant MFA is now the baseline for human identity

At a glance

What this is: This is an identity security analysis arguing that traditional OTP, SMS and push MFA no longer provide reliable human authentication against modern phishing and fatigue attacks.

Why it matters: It matters because IAM teams still running human authentication on shared-secret or prompt-approval patterns are exposing users, privileged access paths and regulated workflows to avoidable takeover risk.

Context

Phishing-resistant MFA has become a human identity issue, not just an authentication feature choice. The article argues that OTP and SMS-based login controls are now routinely defeated by real-time phishing proxies, SIM swap attacks and push fatigue, which means the trust model behind those factors no longer matches current attack methods.

For IAM and PAM teams, the important shift is that authentication assurance now depends on cryptographic binding to the authenticating device and service. That changes how organisations think about enrollment, privileged access, rollout sequencing and user recovery when passkeys or FIDO2 are introduced.

Key questions

Q: What should IAM teams do first when OTP and SMS MFA are still in use?

A: Start by moving privileged users, administrators and anyone who can reset access into phishing-resistant MFA first. That sequence reduces the highest-impact takeover paths before broader rollout begins, and it creates a real operational example for user support, recovery and device provisioning across the rest of the programme.

Q: Why do OTP, SMS and push approvals still fail against phishing?

A: They can be intercepted, relayed or exhausted by attackers before the login completes. OTP and SMS depend on transferable codes, while push approvals can be worn down through repeated prompts. In both cases, the factor can be manipulated through the same human interaction channel the attacker is already targeting.

Q: What breaks when MFA prompts and access checks create authentication fatigue?

A: When prompts become repetitive, people stop paying attention and may approve requests without thinking. The article links this to alert fatigue, mindless approvals, and workarounds that weaken control effectiveness. The failure is not MFA itself, but overuse without context. Continuous, contextual authorization can reduce unnecessary interruptions and keep users engaged with the decision at hand.

Q: What is the difference between passkeys and passwordless MFA?

A: Passkeys use public key cryptography and local user verification, while many passwordless MFA schemes still rely on a shared secret, a push approval, or an OTP. That means passkeys are generally more resistant to phishing and replay. For practitioners, the important question is whether the workflow remains secure once recovery and exception paths are included.

Technical breakdown

Why OTP and SMS MFA are no longer reliable

OTP and SMS MFA rely on shared secrets or time-bound codes that users can type into a login flow. That creates a narrow but real interception window for phishing proxies, man-in-the-middle relays and SIM swap attacks. Because the code is reusable inside the session, an attacker who captures it can often complete authentication before detection or cancellation. The control also assumes the second factor is independent of the first, when in practice both can be coerced through the same social-engineering path. That is why modern phishing campaigns focus on real-time relay rather than password guessing. Practical implication: treat OTP and SMS as weak assurance for anything with meaningful privilege or data exposure.

Practical implication: Treat OTP and SMS as weak assurance for anything with meaningful privilege or data exposure.

How FIDO2 and passkeys change human authentication

FIDO2 and WebAuthn replace shared secrets with public-key cryptography. A passkey creates a credential pair where the private key stays on the device and is bound to the legitimate service origin, so a phishing site cannot replay it against the real domain. User presence or verification on the device is required at the time of use, which blocks approval reuse and removes the central weakness of codes sent across the network. Passkeys are therefore not just more convenient credentials, they are a different trust model for human identity. Practical implication: move authentication policy toward device-bound, origin-bound factors for users who handle sensitive access.

Practical implication: Move authentication policy toward device-bound, origin-bound factors for users who handle sensitive access.

Why push approvals create MFA fatigue risk

Push-based MFA still depends on a user approving a prompt, which makes it vulnerable to repeated-bombing attacks. The attacker does not need to break the factor, only to wear down the user until a malicious approval is granted. Number matching and context-aware prompts reduce that risk by adding more information to the decision, but they still leave the approval model in place. That means the control can be weakened by human behaviour rather than cryptographic failure. Practical implication: use push methods only as an interim control and remove them from high-risk authentication paths where possible.

Practical implication: Use push methods only as an interim control and remove them from high-risk authentication paths where possible.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Human identity authentication is shifting from secret-based proof to origin-bound proof. OTP and SMS MFA were built for a threat model in which the second factor could be trusted if it arrived on the right device at the right time. That assumption fails when attackers can relay, intercept or socially engineer the factor in real time. The implication is that authentication assurance now has to be evaluated by binding, not by delivery method.

Phishing-resistant MFA is not a feature upgrade, it is a change in trust model. FIDO2 and passkeys replace transferable secrets with cryptographic assertions tied to a device and a service origin. That matters because the security property is now replay resistance, not just an extra prompt. For human IAM, the question is whether the factor can be phished at all, not whether it adds friction.

Push approval fatigue shows that human identity controls can fail through behaviour, not only compromise. A prompt that relies on repeated human acceptance becomes part of the attacker path when users are overloaded or conditioned to approve. That means the governance problem is not only factor strength, but the operational design of the approval moment itself. IAM teams need to treat approval fatigue as a control failure mode.

Privileged users should set the authentication baseline for the wider workforce. The article correctly prioritises administrators and high-risk accounts first, because their compromise cost is highest and their workflows most visible. That sequencing should become standard in identity programmes: prove phishing resistance where the blast radius is largest, then extend the control outward. The practitioner conclusion is to anchor rollout strategy in privilege, not convenience.

Cryptographic binding is becoming the practical definition of strong human MFA. In a world of real-time phishing and SIM swap abuse, the decisive question is whether the credential can be replayed elsewhere. Device-bound, origin-bound authentication closes that gap in a way that shared-secret methods cannot. For regulated environments, this is now an assurance issue, not a preference issue.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
• Read next: Passwordless and Passkeys Guide

What this signals

Device-bound verification is becoming the default human identity control for high-risk access. Once authentication depends on a code a user can relay, the attacker only needs a convincing enough prompt. Once it depends on a cryptographic assertion bound to the service origin, the phishing window shrinks dramatically, and that is where modern identity programmes need to move.

Approval-based MFA creates a behavioural control surface that security teams cannot ignore. A factor that can be worn down by repeated prompts is not just an authentication issue, it is a workflow design issue. Teams should treat the approval moment as a governed control point, especially where privileged users are involved.

For practitioners

• Adopt phishing-resistant MFA for privileged users first Start with administrators, help-desk operators and any account that can reach sensitive systems or reset other identities. These users carry the highest takeover impact, and they provide the clearest operational proof point for the rest of the programme.
• Replace SMS and OTP paths with device-bound factors Move authentication to FIDO2 or passkeys where the service can bind the credential to the origin and the user device. Remove code-based fallback for the same accounts, or attackers will simply choose the weakest remaining path.
• Reduce push fatigue exposure If push authentication remains in use during transition, add number matching and context-aware prompts, and monitor for repeated approval attempts against the same user. Repeated prompts are a warning sign that the control is being socially engineered rather than merely challenged.
• Rework recovery and fallback flows Review password reset, device re-enrollment and account recovery paths so they do not reintroduce weaker factors after strong MFA is deployed. The weakest fallback often becomes the real attack surface.
• Tie authentication policy to privilege and data sensitivity Use risk-based enrollment rules so the most sensitive roles are required to use phishing-resistant factors rather than optional adoption. A uniform policy sounds simple, but it often leaves the most valuable accounts on weaker methods longer than necessary.

Key takeaways

• OTP, SMS and push-based MFA no longer provide reliable protection against current phishing and fatigue techniques for human identities.
• Phishing-resistant MFA shifts the control from transferable secrets to device-bound cryptographic verification, which changes the trust model rather than just the user experience.
• IAM teams should prioritise privileged accounts first, because that is where phishing-resistant authentication reduces the greatest risk fastest.

Key terms

• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Passkey: A passkey is a passwordless credential based on public key cryptography. A private key stays on the user’s device, while a public key is stored by the service. During login, the device signs a challenge after local unlock, which reduces phishing and eliminates shared secret reuse.
• MFA Fatigue: MFA fatigue is the behavioural pressure created when repeated login prompts make a person more likely to approve access without checking carefully. It is a control failure in the authentication experience, and it becomes dangerous when the approved session carries broad privilege or long-lived access.
• FIDO2: FIDO2 is a passwordless authentication standard that uses public-key cryptography instead of shared secrets. A service stores the public key while the authenticator keeps the private key, allowing users to prove possession without sending reusable credentials over the network.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.