Multi-Factor Authentication Methods Compared: SMS, Authenticator Apps, Passkeys and Hardware Keys

Multi-factor authentication (MFA) is one of the most effective security controls an organisation can deploy. By requiring something beyond a password, it stops many attacks that rely on stolen or guessed credentials. However, not all MFA methods offer the same level of protection. Some can be intercepted or bypassed by modern phishing techniques, while others are designed to resist them entirely. This article compares the main methods in use today, explains their strengths and weaknesses, and offers practical guidance on choosing the right mix for your organisation.

Why the method matters

Traditional MFA assumed that an attacker who had stolen a password would not also have access to the second factor. Attackers have adapted. Common techniques now include:

• Adversary-in-the-middle phishing, where a fake sign-in page relays the user's password and one-time code to the real service in real time, capturing the session.
• MFA fatigue or push bombing, where repeated approval requests are sent in the hope that the user eventually taps "approve".
• SIM swapping, where a mobile number is transferred to an attacker's device so they receive text message codes.
• Social engineering of help desks to reset or re-register a user's MFA method.

The best methods are those that are phishing-resistant, meaning they cryptographically bind authentication to the genuine website so a fake page cannot reuse the response.

SMS and voice codes

A one-time code is sent by text message or delivered by an automated phone call.

Pros: familiar to almost everyone, works on any mobile phone, and requires no app installation.

Cons: vulnerable to SIM swapping and interception, codes can be entered into phishing sites, and delivery can be unreliable when travelling or in poor coverage areas.

Verdict: far better than a password alone, but the weakest of the common options. Use it as a fallback or transitional method rather than the primary method for sensitive accounts.

Authenticator app codes (TOTP)

An app on a smartphone generates a time-based one-time password (TOTP) that changes every short interval, using a secret shared when the account was set up.

Pros: not dependent on the mobile network, resistant to SIM swapping, works offline, and is widely supported by business and consumer services.

Cons: codes can still be typed into a convincing phishing page and relayed. Users who change phones without transferring their accounts may be locked out.

Verdict: a solid, low-cost improvement over SMS and a sensible baseline for services that do not support stronger methods.

Push notifications with number matching

The sign-in triggers a notification in an authenticator app, and the user approves it. Modern implementations require number matching, where the user types a number shown on the sign-in screen into the app, and display context such as location and application.

Pros: convenient and quick for users, and number matching greatly reduces the risk of accidental approvals from push bombing.

Cons: still not fully phishing-resistant, because a real-time relay attack can present the correct number to the victim. It depends on a smartphone and the vendor's app.

Verdict: a good everyday method for most staff when number matching and additional context are enabled.

Passkeys

Passkeys are based on the FIDO2 and WebAuthn standards. A cryptographic key pair is created for each website: the private key stays on the user's device or in their password manager, and the public key is stored by the service. Signing in requires unlocking the device with a fingerprint, face recognition or PIN.

Pros: phishing-resistant because the key only works for the genuine website; no codes to type; a fast, familiar experience; and nothing useful for attackers to steal from the server.

Cons: support varies across older applications and some enterprise systems. Synced passkeys depend on the security of the platform account that synchronises them, which organisations may wish to control. Recovery processes must be designed carefully.

Verdict: the direction of travel for both consumer and business authentication, combining strong security with good usability. Device-bound passkeys managed by the organisation are particularly suitable for business use.

Hardware security keys

A physical device, typically connecting over USB or NFC, holds the cryptographic keys and performs FIDO2 authentication. The user inserts or taps the key and often enters a PIN.

Pros: the strongest widely available protection against phishing; keys cannot be copied from the device; they work without a smartphone; and they are well suited to shared or restricted environments.

Cons: they carry a purchase cost, must be distributed and managed, can be lost, and every user needs a backup key or a reliable recovery route.

Verdict: ideal for administrators, finance staff, executives and anyone with access to particularly sensitive systems.

Choosing the right mix

Most organisations will use more than one method. A risk-based approach works well:

1. Privileged and high-risk users such as IT administrators, finance approvers and senior leaders should use hardware security keys or device-bound passkeys.
2. General staff should use passkeys where supported, or push notifications with number matching as a minimum.
3. Services that support only codes should use authenticator app codes rather than SMS.
4. SMS should be limited to fallback or recovery scenarios and phased out where possible.

Pair your chosen methods with conditional access policies, which consider device health, location and risk signals before granting access, and with alerts for unusual sign-in activity.

Rollout checklist

• Inventory the applications in use and record which MFA methods each supports.
• Centralise sign-in through a single identity provider where possible, so policies are applied consistently.
• Start with administrators, then expand to all staff in planned phases.
• Communicate clearly: explain why MFA is being introduced, what users will see and how to get help.
• Provide short, practical guides for enrolment on each type of device.
• Design secure recovery: require identity verification before resetting MFA, and never reset over an unverified phone call.
• Issue backup keys or allow registration of more than one method to avoid lock-outs.
• Disable legacy authentication protocols that bypass MFA.
• Monitor registration and sign-in reports to identify users who have not enrolled.
• Review the policy periodically and retire weaker methods as stronger ones become available.

Conclusion

Any form of MFA is far better than relying on passwords alone, but the methods are not equal. SMS codes offer basic protection, authenticator apps and number-matched push notifications provide a sensible everyday standard, and passkeys and hardware security keys deliver genuine resistance to phishing. Prioritise the strongest methods for the people and systems that matter most, invest as much care in recovery processes as in enrolment, and plan a gradual move towards phishing-resistant authentication across the whole organisation.