Phishing-Resistant MFA: FIDO2 Keys, Step by Step

Three attack patterns account for most of the damage we see:

• Adversary-in-the-middle (AiTM) phishing — tools like Evilginx sit between the user and the real site, capturing both the password and the session cookie after MFA succeeds.
• SIM swapping — an attacker convinces (or bribes) a mobile carrier rep to port a number, then receives the victim's SMS codes directly.
• MFA fatigue — a user gets bombarded with push approval requests at 11 p.m. and taps "approve" just to make the noise stop.

FIDO2/WebAuthn hardware keys — YubiKeys, Feitian keys, or platform authenticators tied to a TPM — defeat all three. There's no code to intercept, no number to port, no push to fatigue. The key performs a cryptographic challenge-response that's tied to the origin domain, so it simply refuses to authenticate against a lookalike site.

1. Inventory your identity providers first

Before buying a single key, map out where your users actually authenticate: Microsoft Entra ID, Google Workspace, your VPN, your PAM tool, any SaaS apps with their own login. If you're on Microsoft 365, this is largely a Conditional Access and authentication methods policy exercise, and it's worth having someone who lives in that console handle the rollout — our Microsoft 365 managed services team does this weekly and knows where the gotchas hide, particularly around legacy Exchange authentication and shared mailboxes.

2. Prioritize by risk, not alphabetically

Finance staff who touch wire transfers, executives, IT admins, and anyone with domain admin or privileged access should get keys first. If you're managing privileged accounts, pair this rollout with a real privileged access management strategy — a hardware key on an admin account that still has standing global admin rights only closes half the door.

3. Order keys and run a small pilot

Start with five to ten users, ideally a mix of technical and non-technical staff. Register two keys per person from day one — a primary and a backup stored somewhere other than their desk drawer. Losing the only key someone has is how helpdesks turn into fire drills.

4. Set enrollment as a supervised event, not a self-service email

Send someone a link to "set up your security key" and half of them will ignore it for three weeks. Book fifteen-minute sessions instead, walk each person through registering their key in Entra ID's Security Info page, and confirm it actually works before they leave the room.

5. Enforce with Conditional Access, then kill the fallback methods

Once your pilot group is comfortable, build a Conditional Access policy requiring "phishing-resistant" authentication strength for sensitive apps and privileged roles. The critical, often-skipped step: disable SMS and voice as fallback methods once everyone has a key. Leaving them active as a "backup" defeats the whole project, because attackers will just target whoever hasn't finished enrolling.

6. Handle break-glass accounts deliberately

Every tenant needs at least one emergency access account that isn't tied to a single person's hardware key, protected instead with a long, randomly generated password stored in a sealed physical location. Document it, test it twice a year, and don't let it become the account everyone quietly uses because it's "easier."

7. Roll out in waves, department by department

Trying to flip the switch company-wide in one weekend usually backfires. Move in waves of 15-25 people, keep the previous group's rollout notes handy, and expect the second wave to go noticeably faster than the first.

If your business has between 20 and 99 employees, Texas SB 2610 (effective September 1, 2025) gives you a real incentive here. Implement the CIS Controls IG1 safeguard set — which includes MFA on remote and privileged access — and you're shielded from exemplary damages in a breach-related lawsuit. It doesn't create a new right to sue and it doesn't cover compensatory damages, but it's a meaningful liability reduction for a control you should be running anyway. Combine phishing-resistant MFA with a documented security program and you're in a materially better legal position than a competitor who's still relying on SMS codes.

The financial case is straightforward too. Sophos' 2026 State of Ransomware report puts the median ransomware recovery cost (excluding any ransom paid) at $375,000, and notes that 69% of victims chose not to pay at all — recovery costs hit them regardless. Credential theft through phishing is one of the most common ways ransomware crews get their initial foothold. A key that costs less than a dinner out is cheap insurance against that math.

Hardware MFA keys aren't a replacement for endpoint detection, email filtering, or patching — they're one layer in a broader cybersecurity program. If you're rebuilding your identity and access strategy from scratch, it's worth reviewing your whole managed IT services setup at the same time, since MFA policy, device compliance, and network access controls all need to work together rather than as separate projects bolted on over the years.

How is a FIDO2 key different from an authenticator app?

An authenticator app generates a time-based code that a user can still be tricked into typing into a fake site during an AiTM attack. A FIDO2 key performs a cryptographic exchange tied to the real domain, so it won't complete authentication against a lookalike page at all. Apps are better than SMS, but keys are the stronger control.

Do we need a separate key for every device?

No. One key typically works across a laptop, phone, and tablet as long as each device supports USB-C, NFC, or Bluetooth pairing with the key. Most people carry one key on a keyring and a backup key locked in a drawer or safe.

What happens if an employee loses their key?

This is why every user should register two keys during initial enrollment. If both are lost, an admin revokes the lost credentials and re-enrolls the user with a temporary access pass, ideally in person or over a verified call, not through email alone.

Is this realistic for a smaller business budget-wise?

Hardware keys run roughly $25-$50 per person depending on the model, which is a fraction of what a single credential-theft incident costs to clean up. Many businesses start with their highest-risk users — finance and IT admins — and expand from there rather than buying keys for the whole company on day one.

Does this help with HIPAA or FTC Safeguards Rule compliance?

Phishing-resistant MFA maps directly to access control requirements in both frameworks. If you're covered by HIPAA or the FTC Safeguards Rule, auditors increasingly ask specifically whether your MFA method resists phishing, not just whether MFA exists.

If your current MFA setup is still SMS codes and you're not sure where the gaps are, get a free IT assessment and we'll map out a rollout plan that fits how your team actually works, or just reach out and we'll talk through it.