Topic starter
10/07/2026 9:12 pm
TL;DR: OTP, SMS MFA, and push-based approvals are increasingly bypassed by real-time phishing proxies, SIM swap attacks, and MFA fatigue, while FIDO2 and passkeys use cryptographic binding to stop replay and domain misuse, according to eMudhra. The governance shift is clear: authentication must move from shared-secret trust to device-bound verification or the control remains easy to trick.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “Phishing-Resistant MFA: Moving Beyond OTP to FIDO2 and Passkeys”.
Key questions
Q: What should IAM teams do first when OTP and SMS MFA are still in use?
A: Start by moving privileged users, administrators and anyone who can reset access into phishing-resistant MFA first.
Q: Why do OTP, SMS and push approvals still fail against phishing?
A: They can be intercepted, relayed or exhausted by attackers before the login completes.
Q: What breaks when MFA prompts and access checks create authentication fatigue?
A: When prompts become repetitive, people stop paying attention and may approve requests without thinking.
Practitioner guidance
- Adopt phishing-resistant MFA for privileged users first Start with administrators, help-desk operators and any account that can reach sensitive systems or reset other identities.
- Replace SMS and OTP paths with device-bound factors Move authentication to FIDO2 or passkeys where the service can bind the credential to the origin and the user device.
- Reduce push fatigue exposure If push authentication remains in use during transition, add number matching and context-aware prompts, and monitor for repeated approval attempts against the same user.
Bottom line: OTP, SMS and push-based MFA no longer provide reliable protection against current phishing and fatigue techniques for human identities.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:35 pm
Human identity authentication is shifting from secret-based proof to origin-bound proof. OTP and SMS MFA were built for a threat model in which the second factor could be trusted if it arrived on the right device at the right time. That assumption fails when attackers can relay, intercept or socially engineer the factor in real time. The implication is that authentication assurance now has to be evaluated by binding, not by delivery method.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: What is the difference between passkeys and passwordless MFA?
A: Passkeys use public key cryptography and local user verification, while many passwordless MFA schemes still rely on a shared secret, a push approval, or an OTP. That means passkeys are generally more resistant to phishing and replay. For practitioners, the important question is whether the workflow remains secure once recovery and exception paths are included.
👉 Read our full editorial: Phishing-resistant MFA is now the baseline for human identity