NIST Phishing Resistant MFA Security Keys: Official Guide

If you're asking what to use for phishing-resistant authentication in the US, the National Institute of Standards and Technology (NIST) has already answered: FIDO2 security keys. NIST Special Publication 800-63B, the federal government's digital identity guideline, names FIDO2 and its WebAuthn component as the only widely available technology that meets Authenticator Assurance Level 3 (AAL3), the strictest of NIST's three authentication tiers and the one built specifically to resist phishing.

For a US accounting firm, healthcare practice, or individual choosing between security options, that means a hardware key from a FIDO2-certified vendor, such as YubiKey, Google Titan, or Feitian, beats SMS codes or an authenticator app for any account where phishing is the real threat. SMS and time-based one-time codes still stop basic password guessing, but neither can stop an attacker running a fake login page that relays your code to the real site in real time.

How FIDO2 Security Keys Block Phishing

FIDO2 is an open authentication standard, maintained by the FIDO Alliance, that pairs WebAuthn (the browser-side API) with a physical security key to create a login cryptographically tied to one specific website. When you register a key with an account, it generates a unique key pair for that domain. The private key never leaves the device, and the public key only validates against the real site, so a phishing page using a different domain can't complete the exchange.

That domain binding is why security keys outperform SMS and app-based codes against real-world phishing. According to a study Google conducted with New York University and UC San Diego, security keys blocked 100% of automated bot attacks, 99% of bulk phishing attempts, and 90% of targeted phishing attacks against enrolled accounts (Google Security Blog, 2019). SMS codes remain vulnerable to SIM swap attacks, and authenticator app codes can still be relayed through live phishing kits, which is also how attackers have bypassed some cloud account logins protected by weaker MFA.

What NIST's AAL3 Standard Actually Requires

NIST SP 800-63B ties phishing resistance to Authenticator Assurance Level 3, the strictest of its three authenticator tiers. To qualify, a security key has to store its cryptographic keys in tamper-resistant hardware and support attestation, a way for the service you're logging into to confirm the key itself hasn't been swapped for a fake or software-based substitute.

SMS and voice codes don't meet AAL3 at all. Authenticator app codes fall short too, because both formats can be phished in real time by a fake login page that simply forwards the code to the attacker before it expires. That gap is the main reason NIST, and separately CISA, point specifically to FIDO2 hardware when phishing resistance matters.

Who Needs This in the US: Compliance Context

Tax professionals using IRS e-Services and the Tax Pro Account are required to use multi-factor authentication, and FIDO2 security keys satisfy that requirement at the strongest level currently available. See our guide to two-factor authentication for tax practices for setup specifics. Healthcare practices covered by the HIPAA Security Rule can use security keys to harden access to systems holding protected health information, though HIPAA itself doesn't name a specific authentication technology, so check with your compliance advisor on what your risk analysis requires.

The Cybersecurity and Infrastructure Security Agency (CISA), the US agency that issues national cyber defense guidance, separately recommends phishing-resistant MFA, specifically FIDO2/WebAuthn, as the strongest widely available protection against the kind of social engineering that drives most phishing losses.