Which Multi-Factor Authentication Actually Stops Phishing?
Most Philippine businesses have MFA on something by now. The question that matters in 2026 is which kind. A one-time code by text stops a password thief. It doesn’t stop a fake login page that asks for the code too (see how to spot GCash and Maya phishing texts), and that is how many account takeovers now happen.
Does any MFA help?
Yes, a lot. Microsoft researchers studied real-world attacks on commercial accounts and found MFA reduced the risk of compromise by 99.22%, and by 98.56% even when the password had already leaked. They also found dedicated authenticator apps outperformed SMS codes (Microsoft Research, 2023). So step one is simple: no business account without MFA.
Which MFA methods can phishing get past?
The US cybersecurity agency CISA ranks MFA methods from strongest to weakest. Our summary of its fact sheet (CISA fact sheet):
| Method | Phishing | SIM swap | Push bombing | Where CISA puts it |
|---|---|---|---|---|
| Passkeys / security keys (FIDO2, WebAuthn) | Resistant | Not applicable | Not applicable | The gold standard |
| Authenticator app code, or push with number matching | Vulnerable | Not applicable | Resistant | Best option for SMEs not yet ready for phishing-resistant MFA |
| Push without number matching | Vulnerable | Not applicable | Vulnerable | Weaker: turn on number matching |
| SMS or voice code | Vulnerable | Vulnerable | n/a | Weakest |
The reason passkeys win is simple. A code can be typed into a fake site. A passkey is cryptographically tied to the real website’s address, so it won’t sign in to a look-alike page even if the user is fooled.
What do the rule-makers say now?
- NIST, whose guidance many standards follow, finalized SP 800-63B-4 in 2025. It says OTP authentication “is not phishing-resistant” and requires services at its AAL2 level to offer at least one phishing-resistant option (NIST SP 800-63B-4).
- The BSP has already moved Philippine finance. Under Circular 1213, banks and e-wallets averaging more than ₱75 million a month in online transactions had until 25 June 2026 to replace SMS and email OTPs with stronger authentication for high-risk transactions (GMA News).
- The NPC requires secure authentication, such as MFA, when staff access sensitive personal information online under the Data Privacy Act (NPC Circular 2023-06; RA 10173). Clinics handling patient records can start with what clinics should do.
If your bank no longer trusts an SMS code for a large transfer, your company email, which can reset almost every other account, deserves the same thinking. For a broader starting checklist, see 20–40 PCs is enough to hurt.
What does a sensible rollout look like for a 20 to 100-seat business?
- This week: close the gaps. Every account on MFA, including the owner, shared mailboxes and former staff accounts that should be deleted. Block legacy sign-in methods that skip MFA. The 2026 Philippine incident wrap-up shows how often stolen logins start the trouble.
- This month: upgrade the method. Move staff from SMS codes to an authenticator app with number matching. Turn off SMS as a fallback where you can.
- Next quarter: passkeys for the people attackers want most. Admins, finance, HR and the owner first. Microsoft 365 and Google Workspace both support passkeys and FIDO2 security keys (Microsoft Entra; FIDO Alliance). Issue two keys per admin so a lost key doesn’t lock them out.
- Always: lock down recovery. Attackers who can’t phish the code call the help desk instead. Require a call-back to a number on file, or an in-person check, before anyone resets MFA. Our piece on callback phishing shows how those calls start. That is why social engineering works.
Where should you start?
List who can reset passwords and approve payments, and put them on the strongest MFA first. If you want help mapping it, ARA Industries can review your Microsoft 365 or Google Workspace sign-in settings as part of a cyber health check. Seeing strange MFA prompts right now? Email securenow@ara.ph. Or usap tayo.
General guidance. Product menus and features change; check your admin console and vendor documentation before rolling out.
Frequently asked questions
Is SMS OTP safe for business accounts?
It is better than a password alone, but CISA ranks SMS and voice codes as the weakest form of MFA because they are vulnerable to phishing and SIM swap. Move business accounts to an authenticator app or passkeys.
What is phishing-resistant MFA?
MFA that cannot be relayed through a fake site. In practice that means FIDO2/WebAuthn passkeys or security keys, and PKI-based methods such as smart cards, according to CISA.
What is number matching in MFA?
A push-approval setting that makes the user type the number shown on the sign-in screen into the authenticator app. It stops push-bombing attacks, though it is still not phishing-resistant.
Did the BSP ban SMS OTPs?
BSP Circular 1213 required covered banks and e-wallets to replace SMS and email OTPs with stronger authentication for high-risk transactions by 25 June 2026. Lower-risk transactions may still use SMS OTPs.
