Format3 published
Approaches, evaluation criteria and the questions to ask vendors. We never score, rate or rank products.
Buyer’s guide
Phishing-resistant MFA is authentication that a fake site or man-in-the-middle can’t capture and replay, because the credential is cryptographically bound to the real site. FIDO2 passkeys and hardware security keys are the common examples, and CISA also counts PKI-based smart cards. SMS codes, authenticator-app codes and simple push approvals are not phishing-resistant.
Buyer’s guide
The most direct signal comes from the mobile operator: a SIM swap check reports whether the SIM tied to a number changed recently, and number verification confirms a request comes from that SIM. The CAMARA project standardizes both APIs. Banks combine them with their own device and session signals, and use them before trusting a number for recovery, new payees or high-risk payments.
Buyer’s guide
There is no single best alternative for every flow. Passkeys are the most widely standardized phishing-resistant option and are accepted by NIST at AAL2. In-app approval on a registered device is what UAE and Singapore banks moved customers to. Carrier network checks are useful risk signals, and SIM-based cryptographic methods are emerging. Most organizations combine two or more.