Topic starter
22/06/2026 4:56 pm
TL;DR: Phishing-resistant MFA shifts identity assurance from factor count to origin-bound proof, which Scramble ID says is what blocks relay-based phishing. Recovery and fallback paths can still undo that gain if they quietly allow SMS, TOTP, push approval or help-desk reset.
Editorial analysis by NHI Mgmt Group, based on content published by Scramble ID: “What Is Phishing-Resistant MFA? The Authentication Bar That AI Cannot Defeat”.
Key questions
Q: Why do AiTM phishing kits still succeed against MFA?
A: AiTM kits succeed because they capture the authenticated session, not just the password.
Q: What breaks when recovery flows are not phishing-resistant?
A: The assurance claim breaks at the point of reset, not at the point of login.
Q: How should organisations phase out legacy MFA for sensitive access?
A: Start with privileged users, supplier access, and systems tied to regulated or sensitive data.
Practitioner guidance
- Inventory every authentication path Map web, mobile, desktop, partner, recovery and support-assisted login flows to see where relayable factors still exist.
- Replace relayable factors in high-risk flows Prioritise privileged access, customer-data export and sensitive transaction approval for phishing-resistant authenticators such as FIDO2/WebAuthn or PKI-based methods.
- Harden recovery and fallback Make sure password resets, device replacement, help-desk verification and break-glass access do not fall back to weaker factors that undermine the primary control.
Bottom line: Phishing-resistant MFA changes the control conversation from factor count to origin-bound proof, which is the property that blocks relay-based phishing.
Glossary terms: Phishing-Resistant MFA, Adversary-in-the-middle phishing, Origin binding, Hardware-bound private key
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 21 hours ago by NHI Mgmt Group
22/06/2026 5:07 pm
Phishing-resistant MFA is now an identity assurance baseline, not an enhancement. The old assumption that any MFA meaningfully raises assurance no longer holds once attackers can proxy the entire ceremony. That collapse is not about factor count, it is about whether the authenticator can prove the real relying-party origin. The implication is that identity teams must stop measuring MFA by deployment volume and start measuring it by resistance to relay and replay.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What is the difference between strong MFA and phishing-resistant MFA?
A: Strong MFA means more than one factor is used, while phishing-resistant MFA means the factor cannot be easily captured and replayed by an attacker. A code sent by text may count as MFA, but it is not resistant enough for high-risk accounts because the secret can be stolen outside the application itself. Resistance is the higher standard.
👉 Read our full editorial: Origin-bound MFA, not factor count, now sets the assurance line
This post was modified 21 hours ago by NHI Mgmt Group