[{"data":1,"prerenderedAt":399},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"cmp-\u002Fen\u002Fcomparisons\u002Fmfa-methods-comparison":45,"cmp-alt-\u002Fen\u002Fcomparisons\u002Fmfa-methods-comparison":384,"cmp-others-\u002Fen\u002Fcomparisons\u002Fmfa-methods-comparison":386},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",{"id":46,"title":47,"body":48,"criteria":199,"date":256,"description":257,"extension":258,"faq":259,"keyword":272,"meta":273,"navigation":274,"options":275,"path":346,"rawbody":347,"seo":348,"sources":349,"stem":369,"translationKey":370,"updated":371,"verdict":372,"verified":382,"__hash__":383},"comparisons_en\u002Fen\u002Fcomparisons\u002Fmfa-methods-comparison.md","MFA Methods Compared: SMS, App, Push, FIDO2 Key or Passkey",{"type":49,"value":50,"toc":192},"minimark",[51,55,64,85,90,97,103,109,113,116,119,122,126,129,132,135,139,142,173,176,188],[52,53,54],"p",{},"Turning on multi-factor authentication is table stakes. But \"MFA\" covers very different methods, from a texted code to a physical security key. Against an attacker who relays a fake sign-in page in real time, some hold up and others fail without a sound.",[52,56,57,58,63],{},"This comparison puts the five methods you'll find in most Canadian small businesses side by side. For a walkthrough of the attacks and a rollout plan, see our article on ",[59,60,62],"a",{"href":61},"\u002Fen\u002Fblog\u002Fmulti-factor-authentication-choosing-mfa","choosing your MFA",".",[65,66,69],"callout",{"title":67,"type":68},"Our method","info",[70,71,72,76,79,82],"ul",{},[73,74,75],"li",{},"We compare approaches, not products. Every value in the table is based on publications from NIST, CISA, the Canadian Centre for Cyber Security and the FIDO Alliance, plus Microsoft documentation, reviewed in October 2026.",[73,77,78],{},"Criteria: resistance to three common attacks, NIST status, hardware required, offline use, Microsoft 365 support, cost and recovery when a device is lost.",[73,80,81],{},"The only price quoted comes from a key manufacturer's official site and is indicative.",[73,83,84],{},"This comparison is not sponsored.",[86,87,89],"h2",{"id":88},"three-attacks-that-separate-the-methods","Three attacks that separate the methods",[52,91,92,96],{},[93,94,95],"strong",{},"Real-time relay."," A phishing kit shows a copy of the sign-in page and forwards everything the victim types to the real site, code included. NIST is unambiguous: one-time codes and out-of-band methods such as push and SMS are not phishing-resistant. Only cryptographic authenticators bound to the site's name, such as FIDO2 and WebAuthn, are.",[52,98,99,102],{},[93,100,101],{},"SIM swapping."," A fraudster talks the carrier into moving your number to their SIM card and receives your codes. Only methods that run over the phone network are exposed. That's one reason NIST classifies SMS as \"restricted.\"",[52,104,105,108],{},[93,106,107],{},"Push bombing."," An attacker who already has the password fires off approval requests until the victim gives in. NIST now considers a plain \"Approve \u002F Deny\" prompt unacceptable. Number matching fixes this by making the user type the number shown on screen, and Microsoft applies it to every Authenticator push notification.",[86,110,112],{"id":111},"what-the-authorities-recommend","What the authorities recommend",[52,114,115],{},"The three agencies agree. CISA states that the only widely available phishing-resistant authentication is FIDO\u002FWebAuthn, while reminding readers that any MFA is better than none. For organizations that can't deploy it yet, CISA recommends number matching as an interim step.",[52,117,118],{},"The Canadian Centre for Cyber Security goes further for admin accounts: phishing-resistant MFA without exception, and removal of every vulnerable fallback method. It also acknowledges that these methods often carry a cost that has to be weighed against the risk.",[52,120,121],{},"NIST adds a useful nuance: synced passkeys are allowed up to AAL2, but not at AAL3, which requires a non-exportable private key. For the most sensitive accounts, a hardware key keeps the edge.",[86,123,125],{"id":124},"cost-and-logistics","Cost and logistics",[52,127,128],{},"An entry-level security key sells from US$29 on Yubico's site. Plan two keys per person, one kept somewhere safe: the FIDO Alliance notes that a security key can serve as a recovery credential.",[52,130,131],{},"Passkeys cost nothing extra if your devices are compatible, and all major operating systems and browsers support them. Synced passkeys follow the user from device to device. To sign in on a computer with a passkey stored on a phone, you scan a QR code, and Bluetooth confirms the two devices are close together.",[52,133,134],{},"Have a procedure for lost phones. In Microsoft Entra ID, a Temporary Access Pass lets a user register a new method without falling back to SMS.",[86,136,138],{"id":137},"how-to-choose","How to choose",[52,140,141],{},"Think by account type rather than forcing one method on everyone:",[143,144,145,151,161,167],"ol",{},[73,146,147,150],{},[93,148,149],{},"Administrators"," (Microsoft 365, firewall, backups, domain registrar): FIDO2 keys, two per person, with no weak fallback.",[73,152,153,156,157,63],{},[93,154,155],{},"Finance, payroll and leadership",": passkeys or FIDO2 keys. These are the people targeted by ",[59,158,160],{"href":159},"\u002Fen\u002Fblog\u002Fbusiness-email-compromise-ceo-fraud","business email compromise",[73,162,163,166],{},[93,164,165],{},"All staff",": number matching at minimum, then a move to passkeys.",[73,168,169,172],{},[93,170,171],{},"SMS",": a transition, never a permanent fallback.",[52,174,175],{},"Whatever mix you choose, run a two-week pilot with a few volunteers, ideally including the least tech-savvy person on staff. You'll quickly find the snags: an old laptop with no fingerprint reader, a shared warehouse workstation, a field technician who works in gloves. Then remove the weak methods from the authentication policy itself, not just from users' habits, so an attacker can't fall back on them.",[52,177,178,179,183,184,187],{},"Cyber insurance questionnaires generally ask specific questions about MFA; our guide to ",[59,180,182],{"href":181},"\u002Fen\u002Fblog\u002Fcyber-insurance-questionnaire-requirements","cyber insurance questionnaire requirements"," shows what insurers check. To see where you actually stand, our ",[59,185,186],{"href":13},"Microsoft 365 and Google Workspace audit"," lists the allowed methods, forgotten exclusions and accounts still protected by SMS.",[189,190],"cta",{"variant":191},"devis",{"title":193,"searchDepth":11,"depth":15,"links":194},"",[195,196,197,198],{"id":88,"depth":11,"text":89},{"id":111,"depth":11,"text":112},{"id":124,"depth":11,"text":125},{"id":137,"depth":11,"text":138},[200,205,208,213,220,228,235,241,249],{"label":201,"values":202},"Resists relay through a fake sign-in page",[203,203,203,204,204],"No","Yes",{"label":206,"values":207},"Resists SIM swapping",[203,204,204,204,204],{"label":209,"values":210},"Resists push bombing",[211,211,212,204,204],"Not applicable (nothing to approve)","Yes, thanks to the number entry",{"label":214,"values":215},"Status under NIST SP 800-63B-4",[216,217,217,218,219],"'Restricted' authenticator","Allowed up to AAL2","Eligible for AAL3","AAL2 when synced; AAL3 possible when device-bound",{"label":221,"values":222},"Hardware required",[223,224,225,226,227],"Any cellphone","Smartphone","Smartphone with data","Physical key (USB or NFC)","Compatible phone, computer or password manager",{"label":229,"values":230},"Works without a network",[231,204,232,233,234],"No (cellular signal required)","No (data connection required)","Yes (no phone needed)","Yes on the same device; Bluetooth needed across devices",{"label":236,"values":237},"Supported by Microsoft Entra ID (Microsoft 365)",[204,238,239,204,240],"Yes (software OATH tokens)","Yes (Microsoft Authenticator)","Yes (in Authenticator or synced)",{"label":242,"values":243},"Typical cost",[244,245,246,247,248],"No hardware","Free app","Included in the platform's app","From US$29 per key","None if devices are compatible",{"label":250,"values":251},"If lost",[252,253,253,254,255],"New SIM from the carrier","Re-enrol the app","Backup key or temporary access","Recovery through the sync account (if synced)","2026-10-24","SMS codes, authenticator apps, push with number matching, FIDO2 security keys or passkeys: which MFA method actually stands up to phishing? A side-by-side look.","md",[260,263,266,269],{"q":261,"a":262},"Is SMS still acceptable for MFA?","It beats a password alone, but it's the weakest method in this comparison. NIST classifies it as a 'restricted' authenticator and requires an alternative to be offered. Use it only as a transition, and remove it as a fallback once a stronger method is in place.",{"q":264,"a":265},"What's the difference between a FIDO2 key and a passkey?","They rely on the same FIDO technology. A FIDO2 key is a physical device whose private key never leaves it. A passkey can be synced across your devices by Apple, Google or a password manager, or stay bound to a single device. The FIDO Alliance notes that device-bound passkeys on hardware security keys offer the highest assurance.",{"q":267,"a":268},"Should every employee get a FIDO2 key?","Not necessarily. For most staff, passkeys on managed devices offer the same phishing resistance without buying hardware. Physical keys make the most sense for administrators, finance accounts and employees who share a workstation or have no work phone.",{"q":270,"a":271},"Do passkeys replace passwords?","They can. Microsoft Entra ID accepts passkeys as a primary, passwordless sign-in method. In practice, most small businesses go step by step: the passkey starts as a second factor, then becomes the main method once every device is compatible.","MFA methods",{},true,[276,290,304,318,332],{"name":277,"url":278,"tagline":279,"pricing":280,"bestFor":281,"pros":282,"cons":286},"SMS code","https:\u002F\u002Fpages.nist.gov\u002F800-63-4\u002Fsp800-63b.html","A one-time code texted to a cellphone at each sign-in.","No hardware to buy; built into most platforms, including Microsoft Entra ID","A short transition, or the rare accounts where no other method is possible.",[283,284,285],"Works on any cellphone, no app needed","Almost no training required","Far better than a password alone",[287,288,289],"Vulnerable to SIM swapping and to relay through a fake page","Classified as 'restricted' by NIST (SP 800-63B-4)","Needs cellular coverage at sign-in",{"name":291,"url":292,"tagline":293,"pricing":294,"bestFor":295,"pros":296,"cons":300},"Authenticator app code (TOTP)","https:\u002F\u002Fwww.cisa.gov\u002FMFA","An app that generates a temporary code, refreshed roughly every 30 seconds.","Free apps (Microsoft Authenticator, Google Authenticator and others); smartphone required","Services that offer neither push nor passkeys, and situations with no network.",[297,298,299],"Works with no cellular signal or data","Immune to SIM swapping","Supported by the vast majority of services",[301,302,303],"The code can be relayed in real time by a fake page","Not phishing-resistant according to NIST","Re-enrolment needed if the phone is lost",{"name":305,"url":306,"tagline":307,"pricing":308,"bestFor":309,"pros":310,"cons":314},"Push with number matching","https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fpublications\u002Ffact-sheet-implement-number-matching-in-mfa-applications-508c.pdf","The user types into the app the number shown on the sign-in screen.","Included in the platform's app (e.g., Microsoft Authenticator); smartphone required","The minimum baseline for all staff while you move to passkeys.",[311,312,313],"Stops reflex approvals and push bombing","Simple for users","Enabled for all Microsoft Authenticator push notifications",[315,316,317],"Does not stop real-time relay through a fake page","Needs a smartphone with a data connection","Positioned by CISA as an interim measure",{"name":319,"url":320,"tagline":321,"pricing":322,"bestFor":323,"pros":324,"cons":328},"FIDO2 security key","https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fdefending-against-adversary-middle-threats-phishing-resistant-multi-factor-authentication-itsm30031","A small USB or NFC device that proves identity cryptographically, bound to the real site's domain.","Hardware purchase: from US$29 per key (Yubico Security Key NFC, official site, October 2026); plan two keys per person","Administrators, finance and leadership: the most targeted accounts.",[325,326,327],"Phishing-resistant: a fake page has nothing to relay","Non-exportable private key, eligible for NIST AAL3","No phone required",[329,330,331],"Purchase cost and distribution logistics","A backup key is needed in case of loss","Some older applications don't support it",{"name":333,"url":334,"tagline":335,"pricing":336,"bestFor":337,"pros":338,"cons":342},"Passkey","https:\u002F\u002Ffidoalliance.org\u002Fpasskeys\u002F","A cryptographic key stored on a phone, computer or password manager, unlocked by fingerprint, face or PIN.","No extra hardware if devices are compatible; supported by all major operating systems and browsers","The end goal for all staff, on managed devices.",[339,340,341],"Phishing-resistant","Faster than a password plus a code","When synced, it carries over to a new device",[343,344,345],"When synced, its security depends on the account that syncs it","Synced passkeys are not eligible for NIST AAL3","Cross-device sign-in needs a QR code and Bluetooth","\u002Fen\u002Fcomparisons\u002Fmfa-methods-comparison","---\ntitle: \"MFA Methods Compared: SMS, App, Push, FIDO2 Key or Passkey\"\ndescription: \"SMS codes, authenticator apps, push with number matching, FIDO2 security keys or passkeys: which MFA method actually stands up to phishing? A side-by-side look.\"\ndate: 2026-10-24\nverified: \"October 2026\"\ntranslationKey: mfa-methodes\nkeyword: \"MFA methods\"\noptions:\n  - name: \"SMS code\"\n    url: \"https:\u002F\u002Fpages.nist.gov\u002F800-63-4\u002Fsp800-63b.html\"\n    tagline: \"A one-time code texted to a cellphone at each sign-in.\"\n    pricing: \"No hardware to buy; built into most platforms, including Microsoft Entra ID\"\n    bestFor: \"A short transition, or the rare accounts where no other method is possible.\"\n    pros: [\"Works on any cellphone, no app needed\", \"Almost no training required\", \"Far better than a password alone\"]\n    cons: [\"Vulnerable to SIM swapping and to relay through a fake page\", \"Classified as 'restricted' by NIST (SP 800-63B-4)\", \"Needs cellular coverage at sign-in\"]\n  - name: \"Authenticator app code (TOTP)\"\n    url: \"https:\u002F\u002Fwww.cisa.gov\u002FMFA\"\n    tagline: \"An app that generates a temporary code, refreshed roughly every 30 seconds.\"\n    pricing: \"Free apps (Microsoft Authenticator, Google Authenticator and others); smartphone required\"\n    bestFor: \"Services that offer neither push nor passkeys, and situations with no network.\"\n    pros: [\"Works with no cellular signal or data\", \"Immune to SIM swapping\", \"Supported by the vast majority of services\"]\n    cons: [\"The code can be relayed in real time by a fake page\", \"Not phishing-resistant according to NIST\", \"Re-enrolment needed if the phone is lost\"]\n  - name: \"Push with number matching\"\n    url: \"https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fpublications\u002Ffact-sheet-implement-number-matching-in-mfa-applications-508c.pdf\"\n    tagline: \"The user types into the app the number shown on the sign-in screen.\"\n    pricing: \"Included in the platform's app (e.g., Microsoft Authenticator); smartphone required\"\n    bestFor: \"The minimum baseline for all staff while you move to passkeys.\"\n    pros: [\"Stops reflex approvals and push bombing\", \"Simple for users\", \"Enabled for all Microsoft Authenticator push notifications\"]\n    cons: [\"Does not stop real-time relay through a fake page\", \"Needs a smartphone with a data connection\", \"Positioned by CISA as an interim measure\"]\n  - name: \"FIDO2 security key\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fdefending-against-adversary-middle-threats-phishing-resistant-multi-factor-authentication-itsm30031\"\n    tagline: \"A small USB or NFC device that proves identity cryptographically, bound to the real site's domain.\"\n    pricing: \"Hardware purchase: from US$29 per key (Yubico Security Key NFC, official site, October 2026); plan two keys per person\"\n    bestFor: \"Administrators, finance and leadership: the most targeted accounts.\"\n    pros: [\"Phishing-resistant: a fake page has nothing to relay\", \"Non-exportable private key, eligible for NIST AAL3\", \"No phone required\"]\n    cons: [\"Purchase cost and distribution logistics\", \"A backup key is needed in case of loss\", \"Some older applications don't support it\"]\n  - name: \"Passkey\"\n    url: \"https:\u002F\u002Ffidoalliance.org\u002Fpasskeys\u002F\"\n    tagline: \"A cryptographic key stored on a phone, computer or password manager, unlocked by fingerprint, face or PIN.\"\n    pricing: \"No extra hardware if devices are compatible; supported by all major operating systems and browsers\"\n    bestFor: \"The end goal for all staff, on managed devices.\"\n    pros: [\"Phishing-resistant\", \"Faster than a password plus a code\", \"When synced, it carries over to a new device\"]\n    cons: [\"When synced, its security depends on the account that syncs it\", \"Synced passkeys are not eligible for NIST AAL3\", \"Cross-device sign-in needs a QR code and Bluetooth\"]\ncriteria:\n  - label: \"Resists relay through a fake sign-in page\"\n    values: [\"No\", \"No\", \"No\", \"Yes\", \"Yes\"]\n  - label: \"Resists SIM swapping\"\n    values: [\"No\", \"Yes\", \"Yes\", \"Yes\", \"Yes\"]\n  - label: \"Resists push bombing\"\n    values: [\"Not applicable (nothing to approve)\", \"Not applicable (nothing to approve)\", \"Yes, thanks to the number entry\", \"Yes\", \"Yes\"]\n  - label: \"Status under NIST SP 800-63B-4\"\n    values: [\"'Restricted' authenticator\", \"Allowed up to AAL2\", \"Allowed up to AAL2\", \"Eligible for AAL3\", \"AAL2 when synced; AAL3 possible when device-bound\"]\n  - label: \"Hardware required\"\n    values: [\"Any cellphone\", \"Smartphone\", \"Smartphone with data\", \"Physical key (USB or NFC)\", \"Compatible phone, computer or password manager\"]\n  - label: \"Works without a network\"\n    values: [\"No (cellular signal required)\", \"Yes\", \"No (data connection required)\", \"Yes (no phone needed)\", \"Yes on the same device; Bluetooth needed across devices\"]\n  - label: \"Supported by Microsoft Entra ID (Microsoft 365)\"\n    values: [\"Yes\", \"Yes (software OATH tokens)\", \"Yes (Microsoft Authenticator)\", \"Yes\", \"Yes (in Authenticator or synced)\"]\n  - label: \"Typical cost\"\n    values: [\"No hardware\", \"Free app\", \"Included in the platform's app\", \"From US$29 per key\", \"None if devices are compatible\"]\n  - label: \"If lost\"\n    values: [\"New SIM from the carrier\", \"Re-enrol the app\", \"Re-enrol the app\", \"Backup key or temporary access\", \"Recovery through the sync account (if synced)\"]\nverdict:\n  - profile: \"Microsoft 365 administrators at a 20-person business\"\n    pick: \"FIDO2 security key\"\n    why: \"The Canadian Centre for Cyber Security calls for phishing-resistant MFA on every admin account, without exception. Two keys per person, and no SMS fallback.\"\n  - profile: \"15-person Montréal marketing agency on managed laptops and phones\"\n    pick: \"Passkey\"\n    why: \"Phishing-resistant with no hardware to buy, and faster sign-ins. Keep FIDO2 keys for admin accounts.\"\n  - profile: \"Business still on SMS that needs a stronger MFA within weeks\"\n    pick: \"Push with number matching\"\n    why: \"It's the interim measure CISA recommends when phishing-resistant MFA can't be deployed yet. Then plan the move to passkeys.\"\nfaq:\n  - q: \"Is SMS still acceptable for MFA?\"\n    a: \"It beats a password alone, but it's the weakest method in this comparison. NIST classifies it as a 'restricted' authenticator and requires an alternative to be offered. Use it only as a transition, and remove it as a fallback once a stronger method is in place.\"\n  - q: \"What's the difference between a FIDO2 key and a passkey?\"\n    a: \"They rely on the same FIDO technology. A FIDO2 key is a physical device whose private key never leaves it. A passkey can be synced across your devices by Apple, Google or a password manager, or stay bound to a single device. The FIDO Alliance notes that device-bound passkeys on hardware security keys offer the highest assurance.\"\n  - q: \"Should every employee get a FIDO2 key?\"\n    a: \"Not necessarily. For most staff, passkeys on managed devices offer the same phishing resistance without buying hardware. Physical keys make the most sense for administrators, finance accounts and employees who share a workstation or have no work phone.\"\n  - q: \"Do passkeys replace passwords?\"\n    a: \"They can. Microsoft Entra ID accepts passkeys as a primary, passwordless sign-in method. In practice, most small businesses go step by step: the passkey starts as a second factor, then becomes the main method once every device is compatible.\"\nsources:\n  - title: \"Canadian Centre for Cyber Security: Defending against adversary-in-the-middle threats with phishing-resistant MFA (ITSM.30.031)\"\n    url: \"https:\u002F\u002Fwww.cyber.gc.ca\u002Fen\u002Fguidance\u002Fdefending-against-adversary-middle-threats-phishing-resistant-multi-factor-authentication-itsm30031\"\n  - title: \"NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management\"\n    url: \"https:\u002F\u002Fpages.nist.gov\u002F800-63-4\u002Fsp800-63b.html\"\n  - title: \"CISA: More than a Password (MFA)\"\n    url: \"https:\u002F\u002Fwww.cisa.gov\u002FMFA\"\n  - title: \"CISA: Implementing Number Matching in MFA Applications (fact sheet)\"\n    url: \"https:\u002F\u002Fwww.cisa.gov\u002Fsites\u002Fdefault\u002Ffiles\u002Fpublications\u002Ffact-sheet-implement-number-matching-in-mfa-applications-508c.pdf\"\n  - title: \"FIDO Alliance: Passkeys\"\n    url: \"https:\u002F\u002Ffidoalliance.org\u002Fpasskeys\u002F\"\n  - title: \"Microsoft Learn: authentication methods supported by Microsoft Entra ID\"\n    url: \"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fauthentication\u002Fconcept-authentication-methods\"\n  - title: \"Microsoft Learn: how number matching works in Authenticator\"\n    url: \"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fauthentication\u002Fhow-to-mfa-number-match\"\n  - title: \"Yubico: Security Key NFC (pricing and protocols)\"\n    url: \"https:\u002F\u002Fwww.yubico.com\u002Fca\u002Fproduct\u002Fsecurity-key-nfc-by-yubico\u002F\"\n---\n\nTurning on multi-factor authentication is table stakes. But \"MFA\" covers very different methods, from a texted code to a physical security key. Against an attacker who relays a fake sign-in page in real time, some hold up and others fail without a sound.\n\nThis comparison puts the five methods you'll find in most Canadian small businesses side by side. For a walkthrough of the attacks and a rollout plan, see our article on [choosing your MFA](\u002Fen\u002Fblog\u002Fmulti-factor-authentication-choosing-mfa).\n\n::callout{type=\"info\" title=\"Our method\"}\n- We compare approaches, not products. Every value in the table is based on publications from NIST, CISA, the Canadian Centre for Cyber Security and the FIDO Alliance, plus Microsoft documentation, reviewed in October 2026.\n- Criteria: resistance to three common attacks, NIST status, hardware required, offline use, Microsoft 365 support, cost and recovery when a device is lost.\n- The only price quoted comes from a key manufacturer's official site and is indicative.\n- This comparison is not sponsored.\n::\n\n## Three attacks that separate the methods\n\n**Real-time relay.** A phishing kit shows a copy of the sign-in page and forwards everything the victim types to the real site, code included. NIST is unambiguous: one-time codes and out-of-band methods such as push and SMS are not phishing-resistant. Only cryptographic authenticators bound to the site's name, such as FIDO2 and WebAuthn, are.\n\n**SIM swapping.** A fraudster talks the carrier into moving your number to their SIM card and receives your codes. Only methods that run over the phone network are exposed. That's one reason NIST classifies SMS as \"restricted.\"\n\n**Push bombing.** An attacker who already has the password fires off approval requests until the victim gives in. NIST now considers a plain \"Approve \u002F Deny\" prompt unacceptable. Number matching fixes this by making the user type the number shown on screen, and Microsoft applies it to every Authenticator push notification.\n\n## What the authorities recommend\n\nThe three agencies agree. CISA states that the only widely available phishing-resistant authentication is FIDO\u002FWebAuthn, while reminding readers that any MFA is better than none. For organizations that can't deploy it yet, CISA recommends number matching as an interim step.\n\nThe Canadian Centre for Cyber Security goes further for admin accounts: phishing-resistant MFA without exception, and removal of every vulnerable fallback method. It also acknowledges that these methods often carry a cost that has to be weighed against the risk.\n\nNIST adds a useful nuance: synced passkeys are allowed up to AAL2, but not at AAL3, which requires a non-exportable private key. For the most sensitive accounts, a hardware key keeps the edge.\n\n## Cost and logistics\n\nAn entry-level security key sells from US$29 on Yubico's site. Plan two keys per person, one kept somewhere safe: the FIDO Alliance notes that a security key can serve as a recovery credential.\n\nPasskeys cost nothing extra if your devices are compatible, and all major operating systems and browsers support them. Synced passkeys follow the user from device to device. To sign in on a computer with a passkey stored on a phone, you scan a QR code, and Bluetooth confirms the two devices are close together.\n\nHave a procedure for lost phones. In Microsoft Entra ID, a Temporary Access Pass lets a user register a new method without falling back to SMS.\n\n## How to choose\n\nThink by account type rather than forcing one method on everyone:\n\n1. **Administrators** (Microsoft 365, firewall, backups, domain registrar): FIDO2 keys, two per person, with no weak fallback.\n2. **Finance, payroll and leadership**: passkeys or FIDO2 keys. These are the people targeted by [business email compromise](\u002Fen\u002Fblog\u002Fbusiness-email-compromise-ceo-fraud).\n3. **All staff**: number matching at minimum, then a move to passkeys.\n4. **SMS**: a transition, never a permanent fallback.\n\nWhatever mix you choose, run a two-week pilot with a few volunteers, ideally including the least tech-savvy person on staff. You'll quickly find the snags: an old laptop with no fingerprint reader, a shared warehouse workstation, a field technician who works in gloves. Then remove the weak methods from the authentication policy itself, not just from users' habits, so an attacker can't fall back on them.\n\nCyber insurance questionnaires generally ask specific questions about MFA; our guide to [cyber insurance questionnaire requirements](\u002Fen\u002Fblog\u002Fcyber-insurance-questionnaire-requirements) shows what insurers check. To see where you actually stand, our [Microsoft 365 and Google Workspace audit](\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit) lists the allowed methods, forgotten exclusions and accounts still protected by SMS.\n\n::cta{variant=\"devis\"}\n::\n",{"title":47,"description":257},[350,352,354,356,358,360,363,366],{"title":351,"url":320},"Canadian Centre for Cyber Security: Defending against adversary-in-the-middle threats with phishing-resistant MFA (ITSM.30.031)",{"title":353,"url":278},"NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management",{"title":355,"url":292},"CISA: More than a Password (MFA)",{"title":357,"url":306},"CISA: Implementing Number Matching in MFA Applications (fact sheet)",{"title":359,"url":334},"FIDO Alliance: Passkeys",{"title":361,"url":362},"Microsoft Learn: authentication methods supported by Microsoft Entra ID","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fauthentication\u002Fconcept-authentication-methods",{"title":364,"url":365},"Microsoft Learn: how number matching works in Authenticator","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fentra\u002Fidentity\u002Fauthentication\u002Fhow-to-mfa-number-match",{"title":367,"url":368},"Yubico: Security Key NFC (pricing and protocols)","https:\u002F\u002Fwww.yubico.com\u002Fca\u002Fproduct\u002Fsecurity-key-nfc-by-yubico\u002F","en\u002Fcomparisons\u002Fmfa-methods-comparison","mfa-methodes",null,[373,376,379],{"profile":374,"pick":319,"why":375},"Microsoft 365 administrators at a 20-person business","The Canadian Centre for Cyber Security calls for phishing-resistant MFA on every admin account, without exception. Two keys per person, and no SMS fallback.",{"profile":377,"pick":333,"why":378},"15-person Montréal marketing agency on managed laptops and phones","Phishing-resistant with no hardware to buy, and faster sign-ins. Keep FIDO2 keys for admin accounts.",{"profile":380,"pick":305,"why":381},"Business still on SMS that needs a stronger MFA within weeks","It's the interim measure CISA recommends when phishing-resistant MFA can't be deployed yet. Then plan the move to passkeys.","October 2026","dzVjp2hc04puY_EdYSXw_GGssu5p-B4zu3auoZwbcDA",{"path":385},"\u002Fcomparatifs\u002Fmethodes-mfa-comparatif",[387,391,395],{"path":388,"title":389,"description":390},"\u002Fen\u002Fcomparisons\u002Fantivirus-vs-edr-vs-mdr","Antivirus vs EDR vs MDR: Which Endpoint Protection Do You Need?","Antivirus, EDR or MDR? Detection, response, 24\u002F7 monitoring, in-house skills and cost model compared for small businesses with 10, 50 or 150 employees.",{"path":392,"title":393,"description":394},"\u002Fen\u002Fcomparisons\u002Fbackup-nas-vs-cloud-vs-hybrid","Backups: Local NAS vs Cloud vs Immutable Storage vs Hybrid","On-site NAS, cloud backup, immutable storage or a hybrid 3-2-1-1-0 setup: ransomware resilience, restore speed, cost model and Canadian data residency compared.",{"path":396,"title":397,"description":398},"\u002Fen\u002Fcomparisons\u002Fbusiness-password-managers","1Password vs Bitwarden vs Keeper vs Dashlane for Business","1Password, Bitwarden, Keeper or Dashlane? Canadian data hosting, SSO, SCIM, pricing and compliance compared side by side for Canadian small businesses.",1792972906276]