Phishing-Resistant MFA: Why Number Matching Is Only an Interim Step
A second factor is not automatically phishing-resistant. CISA's guidance explains where push approvals fall short and how to prioritize stronger authentication.
The phrase 'MFA enabled' hides an important question: which method? CISA makes clear that multifactor authentication methods do not all resist the same attacks. For security teams reviewing identity controls this November, the relevant trend is moving beyond enrollment counts to the strength of the actual sign-in method.
More than an extra approval
CISA identifies phishing, push bombing and SIM-swap-related threats among the weaknesses affecting some MFA methods. A user approving a request does not necessarily mean the request came from the legitimate service. Attackers can exploit confusion, repeated prompts or a convincing imitation of the sign-in experience.
CISA urges organizations to implement phishing-resistant MFA. Its guidance describes FIDO/WebAuthn and certificate-based approaches as options. The important property is resistance to a fraudulent sign-in destination, not simply the presence of a second screen or a hardware object.
What number matching does—and does not do
Number matching asks a user to enter or select a number shown in the sign-in flow instead of blindly approving a push. CISA recommends it as an interim measure against MFA fatigue for organizations that cannot yet implement phishing-resistant MFA. It should not be described as equivalent protection.
That distinction belongs in procurement and audit language. A rollout can be worthwhile without resolving the full threat. Calling an interim measure 'phishing-proof' makes it harder to justify the next improvement and gives staff an inaccurate picture of their remaining exposure.
Prioritize the accounts that change everything
- Start with administrators, email accounts and other identities whose compromise enables broad access.
- Inventory the methods each application actually accepts, including fallback sign-in options.
- Pilot phishing-resistant methods and verify compatibility before expanding enrollment.
- Review account recovery: a strong daily sign-in can still be undermined by a weak reset process.
- Use number matching as a documented interim control where a stronger method is not yet available.
During the pilot, test both a successful legitimate sign-in and a simulated fraudulent destination. Also confirm that a lost device does not force support staff to bypass identity checks. These are deployment recommendations, not a claim that any one product eliminates account takeover.
Measure authentication by what an attacker can get a user to approve, not only by how many factors appear on screen.
Sources and scope
Primary source: CISA's guidance on phishing-resistant MFA and number matching, released in 2022. This article applies that established guidance to a current control review; it does not announce a new CISA release.
