Businesses should make phishing-resistant multifactor authentication (MFA) the target state and use SMS codes only as a last-resort fallback. For most organizations, that means deploying FIDO/WebAuthn security keys or passkeys wherever the identity provider, applications and devices support them. The Cybersecurity and Infrastructure Security Agency (CISA) explicitly tells businesses to use the strongest MFA option available and says they should aim for a phishing-resistant method.
SMS is still safer than password-only access, but a one-time text code can be captured through a fake sign-in page, relayed to an attacker in real time, or exposed through telecommunications attacks. A staged rollout can use app-based one-time passwords or number-matched push as interim controls, provided the organization records their limitations and continues toward phishing-resistant MFA.
As an Amazon Associate I earn from qualifying purchases.
The decision in one sentence
Choose FIDO/WebAuthn authentication—implemented with a hardware security key or passkey—as the preferred method for workforce accounts. Keep SMS only where a stronger method is unavailable, and remove it from fallback or recovery paths when the service allows that change without creating a greater lockout risk.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
CISA’s small-business guidance says, “Businesses should aim to use a phishing-resistant MFA method.” Its fact sheet identifies FIDO/WebAuthn and public-key-infrastructure (PKI) authentication as phishing-resistant, while classifying SMS, voice codes, app or token one-time passwords and push notifications as vulnerable to phishing in varying ways. See CISA’s Require Multifactor Authentication guidance and the January 2023 Implementing Phishing-Resistant MFA fact sheet.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What “phishing-resistant” actually means
FIDO/WebAuthn security keys and passkeys
FIDO/WebAuthn uses public-key cryptography. During registration, the authenticator creates a key pair tied to the legitimate website or service. The private key stays with the authenticator; the service stores the public key. At sign-in, the authenticator creates a response for the legitimate origin rather than displaying a reusable code that a user can type into any page.
That origin binding is the important distinction. A criminal can build a convincing imitation of a login page, but the authenticator is not supposed to produce a valid response for that impostor origin. CISA therefore categorizes FIDO/WebAuthn as phishing-resistant. A hardware security key is one physical implementation. A passkey is another supported form factor; CISA lists passkeys as an acceptable option in its mobile communications guidance.
Phishing resistance does not remove every operational problem. Organizations still have to enroll users, cover the devices and browsers they actually use, replace lost authenticators, and maintain a controlled recovery process. Those lifecycle decisions should be made before a broad rollout, not after users start losing access.
SMS codes
With SMS MFA, the service sends a one-time code to the user’s phone. The user reads the message and enters the code into a sign-in form. CISA describes this as a “one-time code” sent to a phone or email in its business guidance, but the code itself is still a secret that can be phished.
An attacker operating a relay site can ask for the password, request the SMS code, and immediately submit both to the real service. CISA also lists exposure to SS7 attacks and SIM-swap attacks. Its December 2024 mobile communications guidance notes that SMS messages are not encrypted and may be read by a threat actor who gains access to a telecommunications provider’s network. These are why SMS is materially weaker for business authentication, even when the code expires quickly.
Method comparison for business access
| Method | Phishing resistance | Other exposure identified by CISA | Practical business role |
|---|---|---|---|
| FIDO/WebAuthn security key or passkey | Phishing-resistant | Push bombing, SS7 and SIM-swap attacks do not apply to this method category in CISA’s comparison | Preferred target where the identity service, applications and devices support enrollment |
| App or token OTP | Vulnerable to phishing because a code entered on a login form can be captured and replayed | SS7 and SIM-swap attacks do not apply to app/token OTP in CISA’s table | Interim control when phishing-resistant MFA cannot be deployed immediately |
| Push with number matching | Still categorized as vulnerable to phishing, although number matching resists push-bombing abuse | SS7 and SIM-swap attacks do not apply to the app-based method in CISA’s table | Better interim choice than push without number matching; do not label it phishing-resistant |
| SMS or voice code | Vulnerable to phishing | SS7 and SIM-swap attacks, plus the risks associated with unencrypted SMS delivery | Last resort when stronger methods are unavailable |
The classifications and attack exposures in this table come from CISA’s Implementing Phishing-Resistant MFA fact sheet and Mobile Communications Best Practice Guidance.
Why “any MFA” is not a sufficient policy
Password-only access leaves a stolen password as the whole credential. Adding a second factor raises the attacker’s workload, which is why CISA advises businesses to enable MFA broadly. However, the second factor determines whether a convincing phishing operation can still complete the login.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A code-based factor is transferable: a user can read it and type it into a page controlled by an attacker. The attacker can then relay it to the real service before it expires. A phishing-resistant authenticator instead verifies the service origin as part of the authentication ceremony. That difference matters most for email, remote access, file storage and administrative systems, where one successful login can expose many other accounts or data stores.
Do not describe number-matched push as phishing-resistant. Number matching addresses push bombing—repeated unsolicited prompts intended to make a user approve one—but CISA still categorizes the method as vulnerable to phishing. It is a sensible improvement over push without number matching while an organization works toward FIDO/WebAuthn.
Who should move first
A rollout does not need to wait until every low-risk account is ready. CISA recommends beginning with the accounts and access paths whose compromise would have the greatest impact.
- Administrators and privileged users: protect accounts that can change identity settings, create users, alter security controls or access broad data sets.
- People handling sensitive information: include finance, legal, health, research, customer and other regulated or confidential data workflows according to the organization’s risk assessment.
- Email: a compromised mailbox can expose resets, invoices, internal conversations and links to other services.
- Remote access: apply the strongest available factor to VPN, remote desktop gateways and other externally reachable entry points.
- File storage and collaboration: protect repositories that contain shared company or customer data.
- Service and automation identities: review non-human access separately; a user security key may not fit an automated workload, so document the approved control rather than silently leaving a password-only exception.
The first five priorities align with CISA’s business and administrator guidance. See CISA’s Identity and Access Management recommendations for administrators for additional implementation context.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteA staged migration plan
1. Inventory identity systems and recovery routes
List each identity provider, major SaaS application, VPN, remote-access gateway, file service and administrative console. Record which MFA methods each system supports, which browsers and operating systems users rely on, and whether enrollment works on managed and unmanaged devices.
Include every recovery route: help-desk resets, backup codes, alternate email addresses, phone numbers, administrator overrides and self-service recovery. An organization that upgrades the sign-in factor but leaves an easily phished recovery path has not removed the underlying exposure.
2. Define the target method by user group
Set FIDO/WebAuthn security keys or passkeys as the required destination for administrators and other high-impact users first. Decide whether users may register more than one authenticator and whether a passkey can be used on a personal or shared device under the organization’s policy.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
For groups that cannot move immediately, specify the interim method and an owner and date for migration. App/token OTP or number-matched push can bridge a compatibility gap, but the policy should state that these methods remain phishable.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitches3. Check compatibility before purchasing or enrolling
Compatibility is not universal. Verify the exact key or passkey implementation against the organization’s identity platform, applications, browser versions, operating systems, mobile-management rules, connectors and remote-access products. Confirm support for the enrollment ceremony, sign-in prompts, account recovery and any device-bound restrictions.
CISA’s guidance names the technology categories and examples of hardware FIDO keys, but it does not provide a current model-by-model compatibility matrix. Test the actual combination used by the business instead of assuming that a key advertised as FIDO2 or WebAuthn will work everywhere.
4. Pilot with administrators and representative users
Start with a small group that includes administrators, remote workers, mobile users, people on different operating systems and users of the most important applications. Test first-day enrollment, normal sign-in, new-device sign-in, browser changes, lost-key reporting, replacement and recovery.
Capture the exact user-facing labels and prompts. A technically correct deployment can still fail if the help desk cannot explain which key to touch, which passkey to select or how to recognize a legitimate origin.
Recommended Free Tools
5. Enroll a second authenticator where the platform supports it
For critical accounts, register a spare security key or another approved phishing-resistant authenticator and store it under controlled conditions. Establish who can issue a replacement, how the old authenticator is revoked, how possession is verified and how the event is logged.
Do not hand out unrestricted emergency credentials as a convenience. A break-glass account should be tightly limited, monitored, protected by a separately controlled factor where feasible and used only under a documented incident or recovery procedure.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Expand by access path, not just by department
After the pilot, require the stronger method for email, remote access, file storage and privileged systems in a deliberate sequence. Publish an enrollment deadline, provide support during the transition and track which accounts still rely on SMS or another interim factor.
7. Remove weaker fallback after testing
Enabling an authenticator app or security key does not automatically disable SMS. Some services retain SMS for recovery even after a stronger method is enrolled. Where the service permits it and the recovery plan is ready, disable SMS fallback. If the platform cannot remove it, document the residual exposure, limit who can use the recovery route and protect help-desk recovery with strong identity verification.
CISA specifically warns that a weaker recovery method can remain exploitable. Its mobile communications guidance explains why organizations should examine SMS beyond the initial login prompt.
8. Review exceptions and retire them
Maintain an exception register for users, applications and devices that cannot use phishing-resistant MFA. Each entry should identify the owner, reason, compensating control and review date. Revisit exceptions when the identity platform, application connector or device fleet changes; otherwise an “temporary” SMS dependency can become permanent.
Recovery, replacement and help-desk controls
Physical authenticators introduce a different failure mode from SMS: a user can lose, damage or forget the device. That is an operational problem, not an argument that SMS is equally secure. Solve it with lifecycle controls.
- Replacement: verify the user’s identity through a procedure that does not rely solely on the factor being replaced, revoke the lost authenticator and issue or enroll the replacement.
- Multiple authenticators: for critical accounts, support a spare key or second approved passkey when the platform allows it.
- Help-desk verification: require documented checks and approval for resets; do not accept an incoming caller’s phone number as proof of identity.
- Break-glass access: keep emergency access rare, time-limited where possible, logged and reviewed after use.
- Joiner, mover and leaver events: enroll new staff, change access when roles change and revoke authenticators promptly when employment or contractor access ends.
These controls are operational recommendations for running a physical-authenticator program. CISA’s sources establish the security advantage of phishing-resistant MFA but do not prescribe one universal key inventory or recovery workflow.
What to do when FIDO/WebAuthn is not yet possible
Use app or token OTP as a bridge
An authenticator app or hardware token that displays a one-time password avoids SS7 and SIM-swap exposure identified for SMS in CISA’s comparison. It remains vulnerable to phishing because the user can enter the code into an attacker’s form, so it should be treated as an interim control rather than the destination.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Prefer number-matched push over unprotected push
Number matching makes a user compare a number on the sign-in screen with the number shown in the approval prompt. That helps resist push bombing, in which an attacker repeatedly sends prompts hoping the user eventually approves one. CISA still categorizes number-matched push as vulnerable to phishing, so it cannot substitute for FIDO/WebAuthn in a policy that requires phishing resistance.
Keep SMS for genuine coverage gaps
SMS may be necessary for users, devices or applications that cannot support another factor. Restrict it to those cases, make the exception visible to security staff and set a migration condition. Do not present SMS as equivalent to a security key or passkey merely because both satisfy a two-factor checkbox.
Procurement and policy questions to answer
Before buying hardware keys or changing enrollment settings, answer these questions in writing:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Which identity provider and applications will enforce WebAuthn or passkeys?
- Which operating systems, browsers, mobile devices and remote-access clients are in scope?
- Will users receive a key, create a passkey, or have a choice based on device policy?
- How many authenticators can a critical account register?
- Where are spare keys stored, and who controls issuance and revocation?
- What happens when a user loses a key, changes phones, changes roles or leaves?
- Which services retain SMS for recovery, and can that setting be removed?
- How are exceptions approved, monitored and retired?
There is no single current security-key model that can be assumed compatible with every business environment. Validate the specific product against the organization’s identity service and devices, then pilot it before committing to a fleet-wide purchase.
Geography, compliance and scope
The recommendations here are based primarily on CISA guidance for U.S. businesses and administrators. They do not by themselves establish a legal requirement for an unspecified industry or jurisdiction. Financial, healthcare, government, education and other regulated organizations should map the chosen MFA method and recovery process to the rules that apply in their location and sector.
Even where a regulation permits SMS, an organization can still choose a stronger control. Conversely, a policy that requires phishing-resistant MFA may need additional technical and procedural controls for legacy applications that cannot perform WebAuthn.
Practical decision checklist
- Use FIDO/WebAuthn security keys or passkeys as the target state.
- Protect administrators, sensitive-data users, email, remote access, file storage and privileged systems first.
- Use app/token OTP or number-matched push only as documented interim methods.
- Keep SMS as a last resort, not the default fallback.
- Test enrollment, sign-in, replacement and recovery with representative users before broad rollout.
- Register spare authenticators for critical accounts where supported.
- Disable SMS recovery after stronger enrollment and recovery have been tested, when the service allows it.
- Record and review every compatibility or recovery exception.
For the business rationale and implementation sequence, use CISA’s small and medium business MFA guidance, its phishing-resistant MFA fact sheet, and its four-goal cybersecurity guidance, which states that SMS should be an organization’s last resort for MFA.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
