MFA strength compared

Multi-factor authentication requires two or more different kinds of evidence. It stops attacks that rely on a stolen or guessed password alone. It does not stop every attack, and the forms of MFA differ a lot in what they resist. This page ranks them using CISA's 2022 fact sheet and maps them to the authentication assurance levels in NIST SP 800-63B-4 (July 2025). It then compares them against the specific attacks that defeat weaker MFA.

Factors and authenticators

SP 800-63B-4 and CISA use the same three factors: something you know (a password or PIN), something you have (a device or key), and something you are (a biometric characteristic). Two details from SP 800-63B-4 trip people up:

• A biometric is never an authenticator on its own. Section 3.2.3: biometrics "SHALL only be used as part of multi-factor authentication with a physical authenticator". A fingerprint that unlocks a security key or phone is an activation factor for that device.
• One device can be two factors. A multi-factor authenticator, such as a security key that needs a PIN or a phone authenticator unlocked by a biometric, provides both factors in a single event. SP 800-63B-4 section 2.2.1 accepts either a multi-factor authenticator or two single-factor authenticators for AAL2.

CISA's ranking, strongest to weakest

CISA's fact sheet Implementing Phishing-Resistant MFA (October 2022), Table 1, lists MFA forms "from strongest to weakest based on their susceptibility" to phishing, push bombing, SS7 exploitation and SIM swap:

CISA also states plainly that "any form of MFA is better than no MFA". Ranking MFA forms is about where to go next, not a reason to remove MFA you already have.

How each form holds up against specific attacks

The first four columns follow CISA's fact sheet. The phishing entries for OTP, push and SMS also follow from SP 800-63B-4: section 3.2.5 requires cryptographic authentication for phishing resistance and says manually entered OTP and out-of-band outputs SHALL NOT be considered phishing-resistant, and section 3.1.3 states that out-of-band authentication is not phishing-resistant. The last column draws on the endpoint-compromise and eavesdropping examples in SP 800-63B-4 Table 3.

"Resists" means the authentication step itself. No authenticator protects a session that has already been established on a compromised endpoint. Session theft is a separate problem.

The underlying reasons are covered on phishing-resistant MFA (why relaying fails against WebAuthn) and OTP and push (push bombing and number matching).

How SP 800-63B-4 assurance levels map

NIST does not rank products. It sets requirements per assurance level, and authenticator types either meet them or not. A simplified mapping (see assurance levels for the full requirements):

For US federal systems, section 2.2.2 goes further: "Federal agencies SHALL require their staff, contractors, and partners to use phishing-resistant authentication to access federal information systems."

Restricted authenticators: SMS and voice

SP 800-63B-4 section 3.2.9 introduces the idea of a restricted authenticator: one that NIST allows but with extra conditions, because its ability to resist attacks has degraded. At publication there is exactly one: "the use of the PSTN for out-of-band authentication", meaning codes sent by SMS or voice call (section 3.1.3.3).

Using a restricted authenticator requires the organization to "assess, understand, and accept the risks". If the relying party finds the risk unacceptable, the restricted authenticator "SHALL NOT be used". When it is used, the CSP SHALL:

1. offer at least one alternative authenticator that is not restricted and works at the required AAL;
2. give subscribers meaningful notice of the security risks and of the unrestricted alternatives;
3. address the additional risks in its risk assessment; and
4. keep a migration plan, in its Digital Identity Acceptance Statement, for the day the restricted authenticator is no longer acceptable.

Section 3.1.3.3 adds that verifiers SHOULD consider risk indicators such as "device swap, SIM change, number porting" before sending a code over the PSTN. Changing the registered phone number counts as binding a new authenticator.

One more change matters for push: the "compare and approve" style of out-of-band authentication, where the user simply approves a prompt, is "no longer considered acceptable" in SP 800-63B-4 because of authentication fatigue. The secret must be transferred between the devices. Details are on OTP and push.

Choosing what to deploy

1. Administrators and high-value users first. CISA suggests IT administrators and help-desk staff as a first phase, and names system administrators, attorneys with e-discovery rights and HR staff as high-value targets. Give them phishing-resistant MFA.
2. Everyone else next. Passkeys and platform authenticators make phishing-resistant MFA practical for whole workforces and for customers. See passkeys.
3. Where you cannot yet, harden what you have. Turn on number matching for push and investigate denied push requests (CISA). Limit the rate of push prompts (SP 800-63B-4 section 3.1.3.2, SHOULD).
4. Retire SMS and voice where possible. If you keep them, meet the restricted-authenticator conditions above and watch for SIM-change signals.
5. Close the side doors. Weak recovery, legacy protocols that bypass MFA, and fallback to weaker methods all undo a strong primary method. See account recovery.

Sources

1. CISA fact sheet: Implementing Phishing-Resistant MFA (October 2022), CISA. Public domain (U.S. government work).
2. NIST SP 800-63B-4: Authentication and Authenticator Management, NIST. Public domain (U.S. government work).