Skip to content
Back to Blog
·10 min read·guides

Phishing-Resistant MFA: Why It's Time to Move Beyond OTP and SMS

Phishing-resistant MFA explained: why SMS and app OTP get bypassed via SIM swap and real-time phishing, and how to migrate to FIDO2 passkeys and keys.

BR

Bachao.AI Research Team

Cybersecurity Research

Get Your Free VAPT Scan

What this means for your business

Indian SMBs without documented security controls face 3× higher breach costs (IBM Cost of a Data Breach 2024). This guide helps you close that gap.

Phishing-resistant MFA means an authentication method — like FIDO2/WebAuthn passkeys or hardware security keys — that cannot be relayed, replayed, or approved by mistake, because the credential is cryptographically bound to the real website and the user's device. SMS OTP and app-based one-time codes fail this test: attackers routinely steal them in real time through phishing proxies, SIM swap fraud, and MFA fatigue attacks. For any Indian business handling money, customer data, or admin access, migrating critical accounts to phishing-resistant MFA is now a baseline control, not an advanced one.

Multi-factor authentication was supposed to be the control that ended account takeover, and for automated, credential-stuffing attacks it largely has. But the specific factor matters. A six-digit code sent by SMS or generated by an authenticator app is still a shared secret that a human has to read and type. Anything a human can be tricked into typing, an attacker can be tricked into receiving. That single fact is why OTP-based MFA is now a known weak point, and why NIST, CISA, and the FIDO Alliance have spent the last several years pushing organizations toward authentication that removes the human from the trust decision entirely.

Why OTP and SMS Codes Are No Longer Enough

SIM swap fraud

SIM swap attacks target the mobile number itself, not the account. An attacker gathers enough personal information about a victim — often from a data leak or a social-engineering call to the telecom operator — to convince the carrier to reissue the victim's number onto a SIM the attacker controls. Every SMS OTP and every "forgot password" text now lands in the attacker's phone; the account owner typically finds out only when their number stops working. This is not theoretical in India: telecom fraud and SIM-swap-enabled banking fraud are recurring categories in RBI and law-enforcement advisories, and it is one reason RBI guidance has pushed banks toward stronger, non-SMS authentication for high-value transactions over the years.

Real-time phishing (adversary-in-the-middle)

The more dangerous shift is real-time phishing kits — sometimes called adversary-in-the-middle (AiTM) proxies. Instead of a crude fake login page that just harvests a password, these kits sit between the victim and the real website, relaying every field the victim submits, including the OTP, in real time. The victim logs into what looks like their real bank, email, or SaaS portal; the kit forwards the credentials and the code to the actual service within seconds and steals the resulting session cookie. Because the OTP is used within its own short validity window, the attacker gets in — and the victim never sees anything wrong. NIST and CISA guidance both call this out: OTP delivered over SMS or generated by an app is "phishable" because the human, not the browser, decides whether the destination is legitimate.

MFA fatigue (push-bombing)

A third pattern targets push-based approval instead of codes. Once an attacker has a valid username and password (bought, leaked, or brute-forced), they trigger repeated push notifications to the victim's phone — sometimes dozens in a row, sometimes at 2 a.m. Some victims approve one out of confusion or fatigue, especially if the attacker follows up with a spoofed IT-support call telling them to "approve it to fix the issue." This social-engineering variant — commonly called MFA fatigue or push bombing — has been used in several high-profile enterprise breaches and is explicitly flagged in CISA's phishing-resistant MFA guidance as a reason to move to number-matching or, better, to phishing-resistant methods entirely.

🚨
DANGER
If your organization's most sensitive accounts — admin panels, email, banking, code repositories — are still protected only by SMS OTP or a basic push app, you are one convincing phone call or one fake login page away from a full account takeover. MFA is necessary but the specific factor determines whether it actually stops a targeted attacker.

What "Phishing-Resistant" Actually Means

NIST Special Publication 800-63B defines phishing resistance as a property of the authentication protocol itself, not user vigilance. A phishing-resistant authenticator cryptographically verifies the origin — the actual domain — it is talking to before it will respond. If a user is tricked into visiting a lookalike domain, the authenticator simply refuses to authenticate: there is no code to steal and no session to relay, because the credential was never designed to work anywhere except the genuine site.

The current gold standard implementing this is the FIDO2/WebAuthn standard, maintained by the FIDO Alliance and the W3C. In practice it shows up in two forms:

    1. Passkeys — a FIDO2 credential stored on a phone, laptop, or password manager, unlocked by the device's own biometric or PIN, and synced (or not) depending on platform settings.
    2. Hardware security keys — physical USB/NFC/Bluetooth devices (FIDO2-certified) that hold the private key on dedicated hardware, never exposing it to the operating system or browser.
Both work the same way under the hood: the website sends a challenge, the authenticator signs it with a private key that never leaves the device, and the signature is only valid for the exact domain that issued the challenge. There is no six-digit code to type, so there is nothing for a phishing proxy to relay.
💡
TIP
Passkeys and hardware keys are also faster for users than typing OTPs — a fingerprint tap or a key insertion, no waiting for an SMS to arrive or hunting for the authenticator app. Security and user experience are aligned here, which makes adoption easier to justify internally.
graph TD A[Choose login MFA method] --> B{Method type} B -->|SMS OTP| C[Phishable via SIM swap] B -->|App OTP TOTP| D[Phishable via AiTM proxy] B -->|Push approval| E[Vulnerable to MFA fatigue] B -->|FIDO2 Passkey| F[Origin-bound, cannot phish] B -->|Hardware security key| G[Origin-bound, cannot phish] C --> H[High risk, avoid for admin or finance accounts] D --> H E --> I[Medium risk, use number matching, still not ideal] F --> J[Recommended for critical accounts] G --> J style A fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style B fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style C fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style D fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style E fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style F fill:#1e3d2f,stroke:#10B981,color:#e2e8f0 style G fill:#1e3d2f,stroke:#10B981,color:#e2e8f0 style H fill:#5f1e1e,stroke:#EF4444,color:#e2e8f0 style I fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style J fill:#1e3d2f,stroke:#10B981,color:#e2e8f0

Relative Phishing Resistance by Method

Ranked qualitatively, from most phishable to most resistant, based on NIST 800-63B and FIDO Alliance guidance:

xychart-beta title "Phishing Resistance by MFA Method (qualitative)" x-axis ["SMS OTP", "App TOTP", "Push Approval", "FIDO2 Passkey"] y-axis "Resistance Level" 0 --> 4 bar [1, 1, 2, 4]

This is a relative ordering, not a measured statistic — no standards body publishes a precise "resistance percentage" for these methods. The direction is what matters: shared-secret codes sit at the bottom regardless of delivery channel, push approval improves only when paired with number matching, and FIDO2-based methods are the only category NIST classifies as resistant to verifier impersonation.

Know your vulnerabilities before attackers do

Run a free VAPT scan — takes 5 minutes, no signup required.

Book Your Free Scan

Comparing the Main MFA Options

MethodHow it worksPhishable via AiTM proxyVulnerable to SIM swapVulnerable to MFA fatigueTypical use case today
SMS OTPCode texted to phone, typed into siteYesYesNoLegacy default, banking OTP
Authenticator app (TOTP)Time-based code from an appYesNoNoCommon SaaS second factor
Push notificationApprove/deny prompt on phonePartially (fatigue attacks)NoYesEnterprise SSO apps
Push with number matchingApprove prompt showing a code to matchPartially reducedNoReducedImproved enterprise SSO
FIDO2 passkeyDevice-bound cryptographic credential, biometric/PIN unlockNoNoNoModern consumer + enterprise logins
Hardware security keyPhysical FIDO2 device, private key never leaves hardwareNoNoNoHigh-value admin, finance, developer accounts
🛡️
SECURITY
Authenticator apps (TOTP) are a real improvement over SMS because they remove the SIM-swap risk, but they are still a shared secret typed by a human — so they remain phishable through the same real-time proxy technique. Don't treat "we use Google Authenticator" as equivalent to phishing-resistant MFA.
250 croreMaximum DPDP Act penalty for failure to implement reasonable security safeguards, incl. weak authentication (MeitY, DPDP Act 2023)
AAL3Highest NIST authenticator assurance level, requires phishing-resistant authentication (NIST SP 800-63B)

Migration Guidance for Indian Businesses

Moving an entire organization to phishing-resistant MFA overnight is unrealistic — most Indian SMBs run a mix of SaaS tools, legacy on-prem systems, and customer-facing logins that don't all support FIDO2 yet. A phased approach works better than an all-or-nothing mandate.

1. Inventory and rank accounts by blast radius. Start with systems that would cause the most damage if compromised: cloud admin consoles, domain registrar and DNS accounts, email/Workspace admin, code repositories, payment gateways, and any account with standing access to customer data. These get phishing-resistant MFA first, regardless of company size.

2. Enable FIDO2/passkey support wherever the provider already offers it. Most major identity providers, cloud platforms, and password managers support FIDO2 natively today — usually a settings toggle, not a project. Enable it for admins first, then extend to all staff.

3. Issue hardware security keys for the smallest, highest-risk group. For founders, IT admins, finance approvers, and anyone with wire-transfer or infrastructure access, a physical FIDO2 key removes even the "phone got compromised" failure mode.

4. Kill SMS OTP as a fallback, not just a primary. A common mistake is enabling passkeys but leaving SMS OTP as an account-recovery fallback — attackers simply target the weaker fallback path instead. Recovery flows need to be at least as strong as the primary factor.

5. Turn on number matching for any push-based MFA you can't replace yet. It's not phishing-resistant, but it raises the bar against blind MFA-fatigue approval and buys time during migration.

6. Train staff on the actual attack, not generic phishing advice. Most employees have never heard of an AiTM proxy or understand why typing a correct OTP into a fake site still compromises them. A short, specific explanation changes behavior more than a generic annual training module does.

⚠️
WARNING
Legacy systems that still require an OTP field with no FIDO2 support are not going away this quarter. Where you can't eliminate OTP, at minimum shorten code validity windows, add device/IP anomaly checks, and monitor for the rapid-approval patterns that indicate an AiTM relay or a fatigue attack in progress.
🎯Key Takeaway
The specific MFA method matters as much as having MFA at all. SMS and app-based OTP protect against automated attacks but not against a targeted, real-time phisher — while FIDO2 passkeys and hardware security keys are cryptographically bound to the real website and cannot be relayed, making them the only category NIST classifies as phishing-resistant. Indian businesses should prioritize migrating admin, financial, and infrastructure accounts first, and treat OTP-based recovery fallbacks as an equal weak point to the primary factor.

Weak authentication rarely shows up as a single obvious flaw — it's usually a gap between what a security policy claims and what a real login flow actually enforces, including recovery paths, fallback factors, and session handling after login. This is exactly the kind of control that continuous vulnerability assessment and penetration testing is built to catch, because it tests the live authentication flow rather than a checklist. Bachao.AI runs automated VAPT that includes authentication and session-security checks as part of a continuous scan, and Dhisattva AI Pvt Ltd built the platform so Indian SMBs don't need an internal security team to find these gaps first. Organizations building out their DPDP Act compliance program can also review authentication controls as part of DPDP compliance readiness, since access control adequacy is directly assessed under the Act.

For more practical, India-specific security guidance, browse the Bachao.AI blog.

Frequently Asked Questions

Is SMS OTP completely useless for security?
No — SMS OTP still stops most automated, credential-stuffing attacks and beats no second factor at all. It fails specifically against real-time phishing and SIM swap fraud, so it should not be the only factor protecting high-value accounts like cloud admin, banking, or domain registrar logins.
What is the difference between a passkey and a hardware security key?
Both use the FIDO2/WebAuthn standard and are equally phishing-resistant. A passkey is a credential stored on a general-purpose device and unlocked with biometrics or a PIN, sometimes synced across devices. A hardware security key is a dedicated physical device where the private key never leaves the hardware, preferred by some organizations for their highest-risk accounts.
Can attackers still bypass FIDO2/WebAuthn authentication?
FIDO2 removes the specific techniques described here — AiTM proxying and OTP theft — because the credential is bound to the origin domain and never transmits a reusable secret. It does not protect against a fully compromised, already-unlocked device, which is why endpoint hygiene remains necessary alongside strong MFA.
How does MFA fatigue actually work?
An attacker who already has a valid username and password triggers repeated push-approval requests, hoping the victim approves one out of confusion, sometimes reinforced by a fake IT-support call. Number matching reduces accidental approvals, but only FIDO2-based methods remove the risk entirely.
Do Indian regulations require phishing-resistant MFA specifically?
RBI guidance pushes toward stronger authentication for financial transactions but doesn't mandate a specific FIDO2 requirement across sectors. The DPDP Act 2023 requires "reasonable security safeguards" for personal data, and weak, easily-bypassed authentication is a defensible gap under that standard even without a named technical mandate.
What should a small business do first if it can't migrate everything at once?
Prioritize the accounts with the largest blast radius — cloud admin, domain/DNS, email admin, code repositories, and payment systems — and move those to FIDO2 passkeys or hardware keys first. Recovery/fallback paths for already-migrated accounts should never be left on SMS OTP.
BR

Bachao.AI Research Team

Cybersecurity Research

AI-powered security research and threat intelligence from the Bachao.AI team. Covering the latest vulnerabilities, CVEs, and cybersecurity developments affecting Indian businesses.

Get cybersecurity insights for Indian SMBs

Weekly vulnerability alerts, DPDP compliance tips, and security guides. No spam — unsubscribe anytime.

We respect your privacy. Your email is never shared.

Know your vulnerabilities before attackers do

Free automated scan — risk score in under 2 hours. No credit card required.

Get Your Free VAPT Scan
Find your vulnerabilitiesStart free scan →