Multifactor Authentication Methods and Their Phishing Resistance

Your phone goes dead at 11:42 on a Tuesday. Five minutes later your email password resets. That is a SIM swap, and it is the moment your two-factor codes stop being a shield and become the attacker's key. Multifactor authentication phishing resistance measures how well a second factor holds up when the factor itself is the target, not the password. A phishing kit deployed on a cloned market login page now captures the one-time code in real time alongside the password, forwarding both to the attacker's backend before the code expires. That real-time relay defeats time-based one-time passwords inside the 30-second window they were designed to protect, and it happens without the victim knowing anything is wrong until funds move.

Continue with the section overview or a closely related question:

• Secure accounts and devices
• Which password should I change first?
• How do I check for unknown account sessions?

Why SMS Codes Fail

Resistance is not binary. Every second factor has a failure mode, and the question is whether the attack scales. SMS-based codes have a bypass rate that spikes whenever a carrier's retail desk accepts a fake ID. Which is often. SIM swap attacks succeed against SMS codes in minutes: the attacker convinces or bribes a mobile carrier employee to port the number to a new SIM. The victim's phone loses service, and every account tied to that number becomes accessible. Defenders measure the gap between the public claim that two-factor stops account takeover and the reality that SIM swap defense is a distinct category of protection SMS does not provide. A hardware security key ties the authentication to a physical device that cannot be ported or forwarded. That is why it ranks highest on any phishing-resistance scale.

What Makes a Factor Phishing-Resistant

Phishing-resistant authentication means the factor cannot be relayed, intercepted, or tricked into approving a different transaction. FIDO2 and WebAuthn protocols bind the authentication to the domain, so a phishing mirror at a lookalike URL cannot complete the handshake. That binding is the technical reason a security key stops session token theft and real-time code capture. Both rely on the victim interacting with the attacker's infrastructure. Push-notification fatigue attacks exploit the gap in weaker methods that ask for a simple tap and hope the user approves without reading. Services that deploy number-matching or geolocation checks close that gap. Adoption is uneven.

Phishing Kits and Real-Time Relays

The darknet does not sell magic. It sells phishing kits, SIM swap services, and info-stealer logs, and all three bypass two-factor in different ways. A phishing kit includes a reverse proxy that sits between the victim and the real login page, capturing the session token once authentication completes. That token is then sold or used immediately. Because the session is already authenticated, no password change or second-factor prompt appears. The bypass rate for these kits is near-total against time-based one-time passwords when the victim is lured to a phishing mirror. The credential reuse rate multiplies the damage: one stolen token for a forum account often unlocks the same user's email or exchange login.

Credential Stuffing and the SIM Swap Link

Credential stuffing is less sophisticated but higher volume. Attackers take breached username and password pairs and spray them across services. When a pair works, the second factor is the only thing standing between the attacker and the account. If that factor is SMS, a SIM swap converts a stuffing attempt into a full takeover. Detection latency on stuffing attacks varies, but the window is measured in hours. By the time the service flags the unusual login pattern, the session token has already been exfiltrated or the account details changed.

Cut the Phone Number Recovery Path

Defending against SIM swap starts with removing the phone number as a recovery path. Attackers do not need your password if they can receive your reset link via SMS. Switch every account that holds funds or personal data to a factor not tied to the mobile carrier: an authenticator app with no SMS fallback, a hardware security key, or a passkey stored in a secure enclave. Carriers offer number-lock and port-freeze features that add friction. The authentication at the retail counter is the weak link, and social engineering bypasses a port freeze roughly as fast as a manager overrides it. SIM swap defense is not a product; it is the decision to treat the phone number as a public identifier and nothing more.

Operational Steps After a Swap

For accounts that demand a phone number at registration, use a number not publicly associated with your identity. The attacker's research phase often begins with a data broker lookup that ties a name to a number. If that number is not the one on the account, the swap attempt stalls. Takedown responsiveness from carriers after a swap is slow, often 24 to 48 hours. The attacker uses that window to drain wallets and lock victims out of recovery channels. Evidence volatility is high in the first hour: call logs, porting confirmations, and SMS intercepts vanish or are overwritten. Preservation must begin before reporting.

Method	Resists SIM Swap?	Resists Session Token Theft?	Resists Real-Time Code Capture?	Typical Bypass Window
SMS one-time code	No	No	No	Minutes after swap
Authenticator app (TOTP)	Partially	No	No	30 seconds per code
Push notification (tap to approve)	Yes	No	Partially	Until user taps
Push with number matching	Yes	Partially	Yes	Seconds during attack
Hardware security key (FIDO2)	Yes	Yes	Yes	None (domain-bound)

Reduce the Token's Value

A session token is a string that keeps you logged in. Stealing it is quieter than stealing a password. Info-stealer malware, delivered via a phishing mirror or a malware loader bundled with a fake software update, exfiltrates every token stored in the browser. Remote access trojans take it further, letting the attacker navigate the victim's active sessions in real time. Session token theft protection begins with reducing the token's value: set short token lifespans in every service that allows it, and log out of sensitive accounts when the session ends. A token that expires in 15 minutes limits the attacker's window more than one that lives for 30 days.

Detection and the Malware Problem

Hardware security keys prevent token theft from a phishing mirror because the token is never exposed to the attacker's domain. The browser enforces the origin check, and the key signs a challenge bound to the real site. For accounts that do not support hardware keys, monitoring for unrecognized active sessions is the fallback. Most services show a list of logged-in devices. A session from a location or browser you do not recognize is the earliest signal of token theft. Malware persistence complicates this: info-stealers reinstall through scheduled tasks, so removing one session does not stop the next exfiltration. Detection latency for token theft is high, often days or weeks. The attacker uses the stolen session quietly to change recovery details and lock out the real owner before draining funds.

The Industrialized Kit Economy

The phishing kit economy has industrialized the gap between what two-factor promises and what it delivers. Kits now include real-time relay modules that proxy the victim's session through the attacker's server, capturing the one-time code and the resulting session token simultaneously. The lure specificity has increased: a victim receives a message referencing a specific transaction or support ticket, follows a link to a phishing mirror that replicates the exact service they use, and enters credentials into a page that passes every visual check. The impersonator account that sent the message disappears within hours. Takedown responsiveness from the hosting provider averages two to three days, by which time the kit has moved to a new domain.

Stack Your Defenses

Phishing-resistant authentication is not a single setting. It is a stack: a hardware security key for the primary login, an authenticator app with no SMS recovery for services that do not support keys, and a separate device for email recovery codes. The claimed-vs-real gap on two-factor protection is widest where a service implies that enabling any second factor stops account takeover. Real-world attacks exploit the weakest factor in the chain. If SMS recovery is still enabled, the strongest primary factor is irrelevant. Evidence admissibility after a phishing incident is low when the victim only has screenshots. Full email headers, the phishing domain, and the wallet address the attacker used are what investigators need. All of them decay within days.