SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/sec-phishing-resistant-gold

Which kind of MFA does CISA call the gold standard?

Phishing-resistant MFA.

Start playing free

  1. Text message codes
  2. Phishing-resistant MFA ✔
  3. Security questions

Why: Some MFA can be tricked by a fake login page that collects your code. Phishing-resistant methods tie the sign-in to the real website, so a fake page gets nothing.

Huh, didn't know that: CISA notes that some systems may not support phishing-resistant MFA yet.

The dad joke
What do you call a fish wearing a bow tie? Sofishticated.
Like this card?
Play the game

References

Answer: Phishing-resistant MFA. Some MFA can be tricked by a fake login page that collects your code. Phishing-resistant methods tie the sign-in to the real website, so a fake page gets nothing.

  1. CISA: Implementing Phishing-Resistant MFA fact sheet www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
    Phishing-resistant MFA is the gold standard for MFA.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyCISA says the only widely available phishing-resistant sign-in method is what?Security & PrivacyWhat is push bombing, also called MFA fatigue?Security & PrivacyWhich sign-in method does CISA list as vulnerable to phishing?

That's stuff everyone should know.