MFA Types Compared: TOTP, Push, SMS, Hardware Keys, and More

Quick Comparison

* Requires identity platform subscription (Microsoft Entra ID, Okta, etc.)

Tiered Recommendations

Method Details

Methods to Avoid

Why Phishing Resistance Matters

Phishing is the most common initial access vector for breaches. When an attacker tricks a user into entering credentials on a fake login page, non-phishing-resistant MFA methods can still be defeated:

• TOTP: The user enters the real TOTP code on the fake site, which the attacker forwards to the real login.
• Basic push: The attacker triggers a push notification during the fake login, and the user approves it thinking it is a legitimate prompt.
• SMS: The attacker forwards the SMS code to the real login in real time.

Hardware keys and number-matched push defeat this pattern because they bind the authentication to the specific domain. The key will not respond to a fake site, and the number match proves the user sees the real login page. This distinction is what NIST SP 800-63B and cyber insurance underwriters care about.

Red Flags in MFA Deployment

Key Takeaways

MFA is not a checkbox. It is a security control that varies dramatically in effectiveness depending on which method you choose and how you deploy it. The right mix depends on your risk profile, user base, and identity platform capabilities. Start with phishing-resistant methods for your highest-risk accounts and build outward from there.

Deployment Considerations

Choosing the right MFA method is only half the challenge. How you roll it out determines whether users adopt it or find ways to bypass it. A poorly planned deployment can create more risk than it removes. The most common failure is mandatory MFA enforcement without adequate user preparation, leading to helpdesk overload and users sharing MFA codes as a workaround.

• Communicate before you enforce. Tell users what is changing, why it matters, and what they need to do. Give them at least a week to register their MFA method before enforcement begins. Users who are surprised by mandatory MFA on login day will flood the helpdesk.
• Start with IT and admins first. If your own team has not enrolled in MFA, you cannot credibly ask the rest of the organization to do it. Admin accounts should be the first to get hardware keys and number-matched push.
• Plan for lost and locked-out devices. Users will lose phones, break hardware keys, and travel to places without cell service. Establish a helpdesk process for MFA reset and recovery before you need it. Keep spare hardware keys in a physical safe for break-glass scenarios.
• Train helpdesk staff on MFA support. Helpdesk agents are the first line of support when users get locked out. They need to understand the difference between MFA methods, know how to verify identity before resetting MFA, and recognize social engineering attempts targeting the helpdesk.
• Monitor adoption and exceptions. Track which users have enrolled and which have not. Follow up with non-compliant users before their grace period expires. Document and time-limit any exceptions, and review them regularly.
• Provide clear documentation. Give users a one-page guide showing how to set up each supported MFA method, what to do if they lose their device, and how to contact the helpdesk. Keep this documentation in a place users can find without asking.

Compliance and Insurance Expectations

MFA requirements have moved from "recommended" to "expected" across most compliance frameworks and insurance carriers. Understanding what your auditors and underwriters look for helps you deploy MFA that satisfies requirements without over-investing.

• Cyber insurance: most carriers now require MFA for email and remote access at minimum. Some require phishing-resistant MFA for privileged accounts. Failure to enforce MFA can result in denied claims or higher premiums.
• NIST SP 800-63B: recommends against SMS-based OTP for sensitive accounts and encourages phishing-resistant authenticators. NIST 800-171 and CMMC require MFA for all users accessing CUI.
• SOC 2 and ISO 27001: expect MFA as part of access control requirements. Auditors look for evidence that MFA is enforced, not just available.
• HIPAA and PCI DSS: require multi-factor authentication for remote access to systems containing protected data. PCI DSS v4.0 specifically mandates MFA for all access to the cardholder data environment.