# MFA Methods Compared: SMS, App, Push, FIDO2 Key or Passkey

Source : https://cybercaribou.com/en/comparisons/mfa-methods-comparison · Cyber Caribou

> SMS codes, authenticator apps, push with number matching, FIDO2 security keys or passkeys: which MFA method actually stands up to phishing? A side-by-side look.

Turning on multi-factor authentication is table stakes. But "MFA" covers very different methods, from a texted code to a physical security key. Against an attacker who relays a fake sign-in page in real time, some hold up and others fail without a sound.

This comparison puts the five methods you'll find in most Canadian small businesses side by side. For a walkthrough of the attacks and a rollout plan, see our article on [choosing your MFA](https://cybercaribou.com/en/blog/multi-factor-authentication-choosing-mfa).

- We compare approaches, not products. Every value in the table is based on publications from NIST, CISA, the Canadian Centre for Cyber Security and the FIDO Alliance, plus Microsoft documentation, reviewed in October 2026.
- Criteria: resistance to three common attacks, NIST status, hardware required, offline use, Microsoft 365 support, cost and recovery when a device is lost.
- The only price quoted comes from a key manufacturer's official site and is indicative.
- This comparison is not sponsored.

## Three attacks that separate the methods

**Real-time relay.** A phishing kit shows a copy of the sign-in page and forwards everything the victim types to the real site, code included. NIST is unambiguous: one-time codes and out-of-band methods such as push and SMS are not phishing-resistant. Only cryptographic authenticators bound to the site's name, such as FIDO2 and WebAuthn, are.

**SIM swapping.** A fraudster talks the carrier into moving your number to their SIM card and receives your codes. Only methods that run over the phone network are exposed. That's one reason NIST classifies SMS as "restricted."

**Push bombing.** An attacker who already has the password fires off approval requests until the victim gives in. NIST now considers a plain "Approve / Deny" prompt unacceptable. Number matching fixes this by making the user type the number shown on screen, and Microsoft applies it to every Authenticator push notification.

## What the authorities recommend

The three agencies agree. CISA states that the only widely available phishing-resistant authentication is FIDO/WebAuthn, while reminding readers that any MFA is better than none. For organizations that can't deploy it yet, CISA recommends number matching as an interim step.

The Canadian Centre for Cyber Security goes further for admin accounts: phishing-resistant MFA without exception, and removal of every vulnerable fallback method. It also acknowledges that these methods often carry a cost that has to be weighed against the risk.

NIST adds a useful nuance: synced passkeys are allowed up to AAL2, but not at AAL3, which requires a non-exportable private key. For the most sensitive accounts, a hardware key keeps the edge.

## Cost and logistics

An entry-level security key sells from US$29 on Yubico's site. Plan two keys per person, one kept somewhere safe: the FIDO Alliance notes that a security key can serve as a recovery credential.

Passkeys cost nothing extra if your devices are compatible, and all major operating systems and browsers support them. Synced passkeys follow the user from device to device. To sign in on a computer with a passkey stored on a phone, you scan a QR code, and Bluetooth confirms the two devices are close together.

Have a procedure for lost phones. In Microsoft Entra ID, a Temporary Access Pass lets a user register a new method without falling back to SMS.

## How to choose

Think by account type rather than forcing one method on everyone:

1. **Administrators** (Microsoft 365, firewall, backups, domain registrar): FIDO2 keys, two per person, with no weak fallback.
2. **Finance, payroll and leadership**: passkeys or FIDO2 keys. These are the people targeted by [business email compromise](https://cybercaribou.com/en/blog/business-email-compromise-ceo-fraud).
3. **All staff**: number matching at minimum, then a move to passkeys.
4. **SMS**: a transition, never a permanent fallback.

Whatever mix you choose, run a two-week pilot with a few volunteers, ideally including the least tech-savvy person on staff. You'll quickly find the snags: an old laptop with no fingerprint reader, a shared warehouse workstation, a field technician who works in gloves. Then remove the weak methods from the authentication policy itself, not just from users' habits, so an attacker can't fall back on them.

Cyber insurance questionnaires generally ask specific questions about MFA; our guide to [cyber insurance questionnaire requirements](https://cybercaribou.com/en/blog/cyber-insurance-questionnaire-requirements) shows what insurers check. To see where you actually stand, our [Microsoft 365 and Google Workspace audit](https://cybercaribou.com/en/services/microsoft-365-google-workspace-audit) lists the allowed methods, forgotten exclusions and accounts still protected by SMS.

## FAQ

**Is SMS still acceptable for MFA?**
It beats a password alone, but it's the weakest method in this comparison. NIST classifies it as a 'restricted' authenticator and requires an alternative to be offered. Use it only as a transition, and remove it as a fallback once a stronger method is in place.

**What's the difference between a FIDO2 key and a passkey?**
They rely on the same FIDO technology. A FIDO2 key is a physical device whose private key never leaves it. A passkey can be synced across your devices by Apple, Google or a password manager, or stay bound to a single device. The FIDO Alliance notes that device-bound passkeys on hardware security keys offer the highest assurance.

**Should every employee get a FIDO2 key?**
Not necessarily. For most staff, passkeys on managed devices offer the same phishing resistance without buying hardware. Physical keys make the most sense for administrators, finance accounts and employees who share a workstation or have no work phone.

**Do passkeys replace passwords?**
They can. Microsoft Entra ID accepts passkeys as a primary, passwordless sign-in method. In practice, most small businesses go step by step: the passkey starts as a second factor, then becomes the main method once every device is compatible.

## Sources

- [Canadian Centre for Cyber Security: Defending against adversary-in-the-middle threats with phishing-resistant MFA (ITSM.30.031)](https://www.cyber.gc.ca/en/guidance/defending-against-adversary-middle-threats-phishing-resistant-multi-factor-authentication-itsm30031)
- [NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management](https://pages.nist.gov/800-63-4/sp800-63b.html)
- [CISA: More than a Password (MFA)](https://www.cisa.gov/MFA)
- [CISA: Implementing Number Matching in MFA Applications (fact sheet)](https://www.cisa.gov/sites/default/files/publications/fact-sheet-implement-number-matching-in-mfa-applications-508c.pdf)
- [FIDO Alliance: Passkeys](https://fidoalliance.org/passkeys/)
- [Microsoft Learn: authentication methods supported by Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-authentication-methods)
- [Microsoft Learn: how number matching works in Authenticator](https://learn.microsoft.com/en-us/entra/identity/authentication/how-to-mfa-number-match)
- [Yubico: Security Key NFC (pricing and protocols)](https://www.yubico.com/ca/product/security-key-nfc-by-yubico/)