# Which MFA methods resist phishing?

Passkeys and hardware security keys based on the FIDO2 standard, and smart cards with certificates. They resist phishing because the key checks the web address it is talking to and will not answer a fake site, so there is no code for the user to type into the wrong place. Authenticator apps with number matching are a solid second choice; codes sent by text message and plain approve-or-deny push prompts are the weakest, because a convincing fake page or a tired user can hand them over. Start with the accounts that matter most: administrators, finance, executives and anyone with access to backups or customer data. Keep a spare key per person and a documented recovery procedure, so that a lost key does not lead to a hurried, insecure reset. MFA lives in your identity provider, not in the network. NetSenX does not see sign-ins; it shows what devices do on monitored segments after any account is used.

FAQ: [Zero trust, identity and segmentation](https://netsenx.com/en/faq/zero-trust) · https://netsenx.com/en/faq/which-mfa-methods-resist-phishing

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What is MFA fatigue, or push bombing?](https://netsenx.com/en/faq/what-is-mfa-fatigue-or-push-bombing)
- [Who holds admin rights in our company, and how do we check?](https://netsenx.com/en/faq/how-to-find-out-who-has-admin-rights)
- [What does least privilege mean in practice?](https://netsenx.com/en/faq/what-is-least-privilege-in-practice)
- [Do service accounts and API tokens need monitoring too?](https://netsenx.com/en/faq/do-service-accounts-and-api-tokens-need-monitoring)
- [Are shared admin accounts a problem, and what should we do instead?](https://netsenx.com/en/faq/how-to-handle-shared-admin-accounts)