MFA Methods Ranked From Weakest to Strongest

Multifactor authentication, or MFA, asks for more than a password before it lets you in. Not all MFA is equal, though. CISA ranks the common methods by how well they resist the attacks used against them.

This guide ranks them from weakest to strongest, using CISA, NIST and the US government's own rules, then shows where Microsoft and the IRS fit. Sources were checked on October 22, 2026.

The short answer

From weakest to strongest, CISA's guidance puts text message or voice codes first, then app prompts without number matching, then app codes and number-matched prompts, and finally phishing-resistant methods based on FIDO or WebAuthn.

Use the strongest method an account offers, and keep a backup method. Any MFA still beats a password alone.

MFA methods meaning

MFA means confirming who you are in more than one way. In practice it means a password plus something you have, such as a phone or key, or something you are, such as a fingerprint.

Two-factor authentication (2FA) is MFA limited to exactly two factors. CISA's MFA page lists two-step verification and 2FA among other names for MFA. Strictly, a two-step sign-in does not always use different factor types.

The ranking

This table follows CISA's categories in its Implementing Phishing-Resistant MFA fact sheet, ordered from weakest to strongest. It is a practical ranking in tiers, not a universal scale, and methods in the same tier are not identical.

Tier	Method	Main limitation
1 (weakest)	Text message and voice codes	Phone network flaws, SIM swapping and phishing
2	App prompt without number matching	Push bombing and phishing
3	Authenticator app codes, token codes and number-matched prompts	Can still be phished
4 (strongest)	FIDO or WebAuthn passkeys and security keys, and PKI-based methods	Phishing-resistant, though recovery and device security still matter

A state banking regulator's MFA fact sheet, citing CISA, calls text and voice the weakest form of MFA and phishing-resistant methods the gold standard.

Tier 3 covers methods that CISA says hold up against push bombing but can still be phished.

Tier 1: text message and voice codes

CISA says attackers can exploit weaknesses in phone communications infrastructure to obtain codes sent by text or voice. A well-known version is SIM swapping, where a criminal takes over your number.

Even so, a texted code is better than no second step. Switch away from it when a stronger option is available, and never read the code to anyone who contacts you.

Tier 2: app prompts without number matching

In a standard push prompt, you tap approve. CISA describes push bombing, also called MFA fatigue, as an attacker spamming you with prompts until you approve one by mistake or from irritation.

CISA recommends number matching, where you enter the number shown on the sign-in screen into the app. It calls it one of the best interim steps if an organization cannot yet move to phishing-resistant MFA.

Tier 3: app codes and number-matched prompts

Authenticator app codes, token-based codes and number-matched prompts all resist push bombing. CISA says they remain vulnerable to phishing, because a convincing fake page can collect a code and use it.

For small and medium businesses that cannot immediately adopt phishing-resistant MFA, CISA describes these as the best option.

Tier 4: phishing-resistant MFA

CISA says the only widely available phishing-resistant authentication is FIDO and WebAuthn. A less common type is PKI-based MFA, such as the smart cards many government agencies use.

Passkeys and security keys rely on these standards. Our explanation: the sign-in is tied to the real website, so a lookalike page cannot reuse it.

What NIST and the US government say

NIST's current guidelines, SP 800-63B-4, were published in July 2025 and replaced the 2020 edition. Applications assessed at authentication assurance level 2, they say, have to provide a phishing-resistant option.

Level 3 calls for a phishing-resistant authenticator and an authentication key that cannot be exported. These are requirements for systems assessed at those levels, not for every consumer website.

The federal zero trust memo M-22-09 goes further. It requires phishing-resistant MFA for federal staff, contractors and partners, and says it must be an option for public users.

MFA methods Microsoft 365 and Entra

Microsoft Entra ID includes three built-in authentication strengths: multifactor, passwordless and phishing-resistant. Administrators can require one in a Conditional Access policy.

Microsoft says the phishing-resistant strength allows Windows Hello for Business or a platform credential, a FIDO2 security key, and Entra certificate-based authentication.

These strengths are Microsoft policy groupings, not a universal ranking of all MFA methods.

Our explanation: a face or fingerprint unlock on a phone or PC usually unlocks a credential held on the device. It does not by itself mean your biometric is sent to the service.

Where Entra methods fit

Entra's methods list includes passkeys, Authenticator push notifications, software OATH tokens, SMS and voice calls. This table maps them to CISA's categories. The mapping is ours.

Entra method	Place in the ranking
Passkey (FIDO2)	Phishing-resistant
Windows Hello for Business	Phishing-resistant, per Microsoft's strength
Authenticator push notification	App prompt
Software OATH token	App code
SMS or voice call	Text or voice code

This follows the type of method. How a method is configured can change its strength, so check your own settings.

MFA methods IRS and ID.me

The IRS says you must have an ID.me account to sign in to your tax information. Its page names MFA protection like an authentication app, a face or touch unlock, or a phone that can receive texts.

The IRS also says ID.me meets NIST's digital identity guidelines. By CISA's ranking, texting is the weakest of those three, so choose the app or device unlock if you can.

The IRS also says it never calls, emails or texts asking you to sign in to get a transcript. Assume any message that asks is a scam.

How to choose

This part is our advice, based on the sources above.

Account recovery is part of MFA

This section is our advice. A strong method can be undone by a weak recovery route, such as a texted code that resets everything. Check which recovery options your account offers.

Store backup codes somewhere safe and offline, and remove recovery routes you no longer control.

CISA's December 2024 mobile guidance warns that enrolling an authenticator app does not automatically remove SMS from the account, which can leave a weak fallback. It advises disabling SMS once you have enrolled.

That guidance is written for highly targeted people, and CISA concedes SMS cannot always be removed. For everyone else, it is still sensible to review every recovery route, including backup numbers and recovery emails.

At work and at home

At work, administrators can enforce a minimum strength, as Entra's authentication strengths do. At home you choose for each account, so start with your email, because it can reset your other accounts.

How authenticator app codes work

The six-digit code in an authenticator app is not magic. It comes from a standard called the time-based one-time password algorithm, described in RFC 6238.

The server and your phone share a secret once, when you scan the setup code. After that, each side calculates the code on its own.

The calculation uses the shared secret and the current time, divided into 30-second steps.

RFC 6238 describes it as a variant of the earlier counter-based method where a time value replaces the counter. It allows stronger hash functions than the default one.

I wrote the algorithm from scratch in a short script and checked it against the test vectors in the RFC. All four matched, so the code is correct.

time         59: computed 94287082 | RFC says 94287082 | MATCH
time 1111111109: computed 07081804 | RFC says 07081804 | MATCH
time 1234567890: computed 89005924 | RFC says 89005924 | MATCH
time 2000000000: computed 69279037 | RFC says 69279037 | MATCH

Then I generated codes for a demo secret across three consecutive 30-second windows, and for the same moment with a secret that differs by one character.

The codes change every window, and a tiny change in the secret gives a completely different code.

three windows:  106848  592052  074453
one character different secret, same moment:  106848 vs 704147

What this tells you

The code is useless without the secret. An attacker who watches one code gets nothing they can reuse after the window ends. That is why app codes beat static passwords.

It also explains the weakness. If a fake site asks for your code and passes it to the real site within seconds, the attacker gets in.

The code proves you have the secret, but it cannot tell whether you are typing it into the right site. Security keys and passkeys solve that, because they check the site address. Our phishing guide covers the fake sites.

Prompt bombing and number matching

Push notifications have their own trap. An attacker who already has your password triggers approval request after approval request, hoping you will tap approve to make it stop. The common name is MFA fatigue or prompt bombing.

Microsoft's documentation on number matching describes one defense. When you respond to a push notification in Authenticator, you see a number on the sign-in screen and must enter it in the app.

It says number matching is enabled for all Authenticator push notifications. You cannot approve by reflex, because you must have the screen in front of you.

If you ever get an approval prompt you did not start, deny it, change your password and report it. A prompt you did not trigger means someone has your password.

How to choose a method

Ask four questions, in this order. This guide is our advice, and it builds on the ranking earlier in this article.

• What does the account protect? Use the strongest method for email, banking, administrator accounts and anything that resets other passwords.
• Who is the attacker? If phishing is the main risk, choose a method that checks the site address, such as a security key or a passkey.
• What will people actually use? A strong method that people avoid is weaker than a good method everyone uses.
• What happens when it is lost? Plan recovery before you need it.

Roll it out in a small organization

Start with administrators and email, because they are the highest risk. Next, cover finance and anyone who can move money. Then cover everyone else. Give each person two methods so that a lost phone does not lock them out.

Write a recovery process that checks identity without making it easy to impersonate someone. Impersonating staff to the help desk is a common attack, so do not reset multifactor authentication on a phone call alone.

Lost phone and recovery

When you set up an authenticator app, save the recovery codes the service gives you and keep them offline. Consider registering a second device or a security key as a backup.

If you lose your phone, use a recovery code first. If you have none, the service will run a slower identity check, and that can take days. A few minutes of preparation saves that delay.

Frequently asked questions

Which MFA method is strongest?

Phishing-resistant MFA based on FIDO or WebAuthn, such as a passkey or a security key. PKI-based smart cards are also phishing-resistant.

Is SMS MFA bad?

It is the weakest category in CISA's ranking, but it still beats having only a password.

What is number matching?

A setting where you type in the number from the sign-in screen, so nobody can approve a prompt by accident.

What MFA does the IRS use?

It uses ID.me. The IRS lists an authentication app, face or touch unlock, or a phone with texting.

Are authenticator apps safe?

They resist push bombing, but CISA says they remain vulnerable to phishing.

How does an authenticator app work?

The app and the server share a secret, then both calculate a code from the secret and the current 30-second window.

What is MFA fatigue?

An attacker with your password sends repeated approval requests in the hope that you will tap approve. Number matching helps stop it.

What should I do if I lose my phone?

Use a saved recovery code or a backup method. Prepare these before you need them.

A quick checklist

• Turn on MFA for your email, banking and work accounts.
• Choose a passkey or security key when one is offered.
• Switch from texts to an app where you can.
• Decline any prompt you did not trigger.
• Register a backup method.

Up nextZero trust explained without the buzzwordsMFA is one control inside a bigger design. Read our guide to zero trust explained without the buzzwords.→