Multi-factor authentication (MFA) is the single most repeated piece of security advice in the industry — and rightly so. Adding a second factor blocks the overwhelming majority of password-based attacks. But here is the uncomfortable truth most vendors skip over: not all MFA is equal, and the most common forms are now being bypassed routinely.
If your organisation relies on SMS one-time pins or simple push approvals, you have meaningfully reduced your risk — but you have not eliminated the attack that matters most in 2026: real-time phishing. This guide explains the difference between phishable and phishing-resistant MFA, what passkeys actually are, and how South African businesses can move to stronger authentication without disrupting their people.
Why "MFA On" Is No Longer Enough
When MFA first became mainstream, attackers simply moved on to softer targets. That is no longer the case. Adversaries have industrialised techniques specifically designed to defeat the weaker MFA methods.
Three attacks dominate:
Adversary-in-the-middle (AiTM) phishing.
The victim is lured to a convincing fake login page that sits between them and the real service. When the user enters their password and their one-time pin, the attacker's proxy relays both to the genuine site in real time — and captures the resulting session cookie. The attacker is now logged in as the user. The one-time pin did its job and still failed, because it was simply passed through.
MFA fatigue (push bombing).
The attacker, already holding a stolen password, triggers push approval prompts over and over until a tired or distracted user taps "Approve" just to make them stop.
SIM swapping.
Particularly relevant in South Africa, where SIM-swap fraud is well documented. An attacker convinces or bribes a mobile operator to port the victim's number to a new SIM, intercepting every SMS code.
The common thread: SMS codes, emailed codes, and basic push approvals are all phishable. They can be relayed, intercepted, or socially engineered. Phishing-resistant MFA is built to make that impossible.
What Makes MFA "Phishing-Resistant"
Phishing-resistant MFA removes the shared secret that an attacker can capture and replay. Instead of a code the user types in, it uses cryptographic proof that is bound to the specific website and the specific device.
Two technologies deliver this today:
FIDO2 / WebAuthn
FIDO2 is an open standard built around public-key cryptography. When you register a credential, your device generates a key pair. The private key never leaves the device; only the public key is stored by the service. At sign-in, the device proves it holds the private key — and critically, the browser checks that the request comes from the exact domain the credential was registered for.
This single design choice defeats AiTM phishing. A credential registered for login.yourcompany.co.za will simply refuse to authenticate against login.yourcompany-secure.co.za. The fake site never receives anything it can replay, because the cryptographic challenge is bound to the legitimate origin.
Passkeys
A passkey is a FIDO2 credential made consumer-friendly. The term covers two forms:
- Device-bound passkeys live on a single piece of hardware — a security key (such as a YubiKey) or the secure element of a phone or laptop. They never leave that device.
- Synced passkeys are backed up to a platform account (Apple iCloud Keychain, Google Password Manager, or Microsoft) and roam across a user's devices.
In practice, a passkey lets a user sign in with the same gesture they use to unlock their phone or laptop — a fingerprint, a face scan, or a PIN. There is no code to type, nothing to copy from an SMS, and nothing for a fake site to steal. The user experience is genuinely faster than passwords, which is why adoption tends to stick.
Phishable vs Phishing-Resistant: A Clear Comparison
| Method | Phishing-resistant? | Resists SIM swap? | Resists push fatigue? | User effort |
|---|---|---|---|---|
| SMS one-time pin | No | No | N/A | Moderate |
| Email one-time pin | No | Yes | N/A | Moderate |
| Authenticator app (TOTP code) | No | Yes | N/A | Moderate |
| Standard push approval | No | Yes | No | Low |
| Number-matching push | Partial | Yes | Yes | Low |
| FIDO2 security key | Yes | Yes | Yes | Low |
| Passkey (platform or roaming) | Yes | Yes | Yes | Very low |
Number matching — where the user types a number shown on screen into their authenticator app — is a worthwhile interim step. It defeats blind push fatigue. But it is still phishable through a real-time proxy. Treat it as a stepping stone, not a destination.
A Practical Rollout for South African Organisations
You do not need to flip the entire organisation to passkeys overnight. A phased, risk-led rollout delivers the biggest security gains first while giving users time to adapt.
Phase 1 — Protect Your Highest-Risk Accounts
Start where a compromise would hurt most: administrators, finance, executives, and anyone with privileged access. Issue FIDO2 security keys to these users and require phishing-resistant authentication for any administrative role.
In Microsoft Entra ID, this is enforced through an authentication strength policy applied via Conditional Access. You can mandate that privileged sign-ins accept only phishing-resistant methods — no SMS, no fallback to a typed code.
Phase 2 — Enable Passkeys for the General Workforce
With administrators secured, extend passkeys to everyone else. Most modern Windows, macOS, iOS, and Android devices support them natively, so the majority of staff can enrol using hardware they already carry. Provide a short enrolment guide and a walk-through during onboarding.
For shared or kiosk devices common in clinical, retail, and plant-floor environments, roaming security keys are usually the better fit, since the credential travels with the person rather than the machine.
Phase 3 — Reduce Reliance on Weaker Methods
As passkey coverage grows, begin retiring SMS as a factor. Move users to number-matching push as a minimum baseline, then steer them toward passkeys. Keep a small number of monitored break-glass accounts with their own carefully controlled strong authentication, so you are never locked out of your own tenant.
Phase 4 — Monitor and Tighten
Use Entra sign-in logs to track which methods are actually being used. Identify users still falling back to SMS and target them for enrolment support. Over time, raise the authentication strength requirement for more applications until phishing-resistant MFA becomes the default rather than the exception.
Where This Fits in a Zero-Trust Strategy
Phishing-resistant MFA is the identity pillar of zero trust done properly. "Never trust, always verify" only holds if the verification itself cannot be stolen. Strong authentication pairs naturally with Conditional Access policies that also check device health and sign-in risk — so access decisions rest on cryptographic proof of identity, not a code a determined attacker can phish.
It also supports POPIA's expectation of appropriate security safeguards. Access control is a core requirement, and demonstrating that privileged access is protected by phishing-resistant authentication is concrete, auditable evidence of due diligence.
How OAS Helps
OAS designs and deploys phishing-resistant authentication as part of a managed identity and security service. As a long-standing Microsoft and SentinelOne partner with over 40 years in the South African market, we help organisations:
Assess
current MFA coverage and identify the phishable gaps
Configure
Entra Conditional Access and authentication strength policies
Roll out
passkeys and FIDO2 security keys with a plan that fits your workforce
Monitor
adoption and progressively retire weaker methods
Stronger authentication does not have to mean a worse experience. Done well, it is both safer and faster for your people.
Your password is not the problem. Phishable MFA is.
OAS deploys phishing-resistant authentication that attackers cannot relay.
Strengthen Your Authentication →