MFA Methods Compared: SMS, App, Push, FIDO2 Key or Passkey
SMS codes, authenticator apps, push with number matching, FIDO2 security keys or passkeys: which MFA method actually stands up to phishing? A side-by-side look.
Facts verified : October 2026This comparison is not sponsored.
Our recommendation for your situation
Microsoft 365 administrators at a 20-person business
FIDO2 security key
The Canadian Centre for Cyber Security calls for phishing-resistant MFA on every admin account, without exception. Two keys per person, and no SMS fallback.
15-person Montréal marketing agency on managed laptops and phones
Passkey
Phishing-resistant with no hardware to buy, and faster sign-ins. Keep FIDO2 keys for admin accounts.
Business still on SMS that needs a stronger MFA within weeks
Push with number matching
It's the interim measure CISA recommends when phishing-resistant MFA can't be deployed yet. Then plan the move to passkeys.
Side-by-side comparison
Criterion
SMS code
Authenticator app code (TOTP)
Push with number matching
FIDO2 security key
Passkey
Resists relay through a fake sign-in page
No
No
No
Yes
Yes
Resists SIM swapping
No
Yes
Yes
Yes
Yes
Resists push bombing
Not applicable (nothing to approve)
Not applicable (nothing to approve)
Yes, thanks to the number entry
Yes
Yes
Status under NIST SP 800-63B-4
'Restricted' authenticator
Allowed up to AAL2
Allowed up to AAL2
Eligible for AAL3
AAL2 when synced; AAL3 possible when device-bound
Hardware required
Any cellphone
Smartphone
Smartphone with data
Physical key (USB or NFC)
Compatible phone, computer or password manager
Works without a network
No (cellular signal required)
Yes
No (data connection required)
Yes (no phone needed)
Yes on the same device; Bluetooth needed across devices
A cryptographic key stored on a phone, computer or password manager, unlocked by fingerprint, face or PIN.
Best for
The end goal for all staff, on managed devices.
Pricing
No extra hardware if devices are compatible; supported by all major operating systems and browsers
Strengths
Phishing-resistant
Faster than a password plus a code
When synced, it carries over to a new device
Limitations
When synced, its security depends on the account that syncs it
Synced passkeys are not eligible for NIST AAL3
Cross-device sign-in needs a QR code and Bluetooth
Turning on multi-factor authentication is table stakes. But "MFA" covers very different methods, from a texted code to a physical security key. Against an attacker who relays a fake sign-in page in real time, some hold up and others fail without a sound.
This comparison puts the five methods you'll find in most Canadian small businesses side by side. For a walkthrough of the attacks and a rollout plan, see our article on choosing your MFA.
Our method
We compare approaches, not products. Every value in the table is based on publications from NIST, CISA, the Canadian Centre for Cyber Security and the FIDO Alliance, plus Microsoft documentation, reviewed in October 2026.
Criteria: resistance to three common attacks, NIST status, hardware required, offline use, Microsoft 365 support, cost and recovery when a device is lost.
The only price quoted comes from a key manufacturer's official site and is indicative.
Real-time relay. A phishing kit shows a copy of the sign-in page and forwards everything the victim types to the real site, code included. NIST is unambiguous: one-time codes and out-of-band methods such as push and SMS are not phishing-resistant. Only cryptographic authenticators bound to the site's name, such as FIDO2 and WebAuthn, are.
SIM swapping. A fraudster talks the carrier into moving your number to their SIM card and receives your codes. Only methods that run over the phone network are exposed. That's one reason NIST classifies SMS as "restricted."
Push bombing. An attacker who already has the password fires off approval requests until the victim gives in. NIST now considers a plain "Approve / Deny" prompt unacceptable. Number matching fixes this by making the user type the number shown on screen, and Microsoft applies it to every Authenticator push notification.
The three agencies agree. CISA states that the only widely available phishing-resistant authentication is FIDO/WebAuthn, while reminding readers that any MFA is better than none. For organizations that can't deploy it yet, CISA recommends number matching as an interim step.
The Canadian Centre for Cyber Security goes further for admin accounts: phishing-resistant MFA without exception, and removal of every vulnerable fallback method. It also acknowledges that these methods often carry a cost that has to be weighed against the risk.
NIST adds a useful nuance: synced passkeys are allowed up to AAL2, but not at AAL3, which requires a non-exportable private key. For the most sensitive accounts, a hardware key keeps the edge.
An entry-level security key sells from US$29 on Yubico's site. Plan two keys per person, one kept somewhere safe: the FIDO Alliance notes that a security key can serve as a recovery credential.
Passkeys cost nothing extra if your devices are compatible, and all major operating systems and browsers support them. Synced passkeys follow the user from device to device. To sign in on a computer with a passkey stored on a phone, you scan a QR code, and Bluetooth confirms the two devices are close together.
Have a procedure for lost phones. In Microsoft Entra ID, a Temporary Access Pass lets a user register a new method without falling back to SMS.
Think by account type rather than forcing one method on everyone:
Administrators (Microsoft 365, firewall, backups, domain registrar): FIDO2 keys, two per person, with no weak fallback.
Finance, payroll and leadership: passkeys or FIDO2 keys. These are the people targeted by business email compromise.
All staff: number matching at minimum, then a move to passkeys.
SMS: a transition, never a permanent fallback.
Whatever mix you choose, run a two-week pilot with a few volunteers, ideally including the least tech-savvy person on staff. You'll quickly find the snags: an old laptop with no fingerprint reader, a shared warehouse workstation, a field technician who works in gloves. Then remove the weak methods from the authentication policy itself, not just from users' habits, so an attacker can't fall back on them.
It beats a password alone, but it's the weakest method in this comparison. NIST classifies it as a 'restricted' authenticator and requires an alternative to be offered. Use it only as a transition, and remove it as a fallback once a stronger method is in place.
What's the difference between a FIDO2 key and a passkey?+
They rely on the same FIDO technology. A FIDO2 key is a physical device whose private key never leaves it. A passkey can be synced across your devices by Apple, Google or a password manager, or stay bound to a single device. The FIDO Alliance notes that device-bound passkeys on hardware security keys offer the highest assurance.
Should every employee get a FIDO2 key?+
Not necessarily. For most staff, passkeys on managed devices offer the same phishing resistance without buying hardware. Physical keys make the most sense for administrators, finance accounts and employees who share a workstation or have no work phone.
Do passkeys replace passwords?+
They can. Microsoft Entra ID accepts passkeys as a primary, passwordless sign-in method. In practice, most small businesses go step by step: the passkey starts as a second factor, then becomes the main method once every device is compatible.