You get a message: "Unusual activity. Please sign in again."
You click. The icon, the colors, the font — exactly like the real site.
You type your password. You even check: two-factor is on. You feel safe.
The next day, the account is gone. Someone is using your name to ask your friends for money.
What went wrong?
Not a weak password. Not a useless one-time code. The page was fake.
Phishing is not "guessing your password." It is a fake page plus a live relay.
The attacker puts a fake page in front of the real site.
You think you are talking to the site. In fact, someone sits in the middle.
Whatever you hand over, they pass it on — to the real site.
So the real question is not "how strong is my password?" It is:
Can the thing you use be handed over?
Five login methods, side by side
| Method | What proves it | Can it be handed over? | Phishing-resistant | Main weakness |
|---|---|---|---|---|
| Password | something you remember | Yes — typed straight into the fake page | No | reuse, leaks |
| SMS code | a code sent to your phone | Yes — the attacker asks you for it | No | SIM swap, live relay |
| Magic link | a link in your email | Yes — whoever finds it, gets in | No | link theft |
| QR login | your logged-in phone confirms a number | Yes — the number can be swapped | Partial | wrong code, swapped code |
| Passkey | a key inside your device | No — the key never leaves the device, and it only trusts the site it registered with | Yes | lost device, cross-device sync |
In one line: if it can be spoken, typed, or clicked open, it can be handed over.
A short history
| When | What happened |
|---|---|
| 1990s | "Phishing" appears: fake email + fake page to steal passwords |
| 2019 | W3C publishes the WebAuthn standard (the basis of phishing resistance) |
| 2022 | Apple, Google, and Microsoft push Passkeys |
| 2022 | Microsoft reports a wave of "adversary-in-the-middle" phishing that steals the login session too |
The direction is clear: take the key out of the network, and lock it in the device.
There is only one test
A fake page sits between you and the real site
You (something hand-over-able) -> fake page -> real site <- the hand copies it
You (Passkey) -> x the fake page is not trusted -> cannot be handed over
Why does a Passkey resist phishing? Two reasons:
- The key lives inside your device. It never leaves.
- It only trusts the exact site it registered with. Wrong address, no deal.
A fake page is simply not trusted. Even if you wanted to hand it over, you cannot.
What the standards say
- NIST SP 800-63B-4 (2025): passwords, look-up secrets, and out-of-band (SMS/QR) are not phishing-resistant. Higher assurance levels require phishing resistance.
- Microsoft (2022): an AiTM wave stole password + login session together, and walked past MFA; by its own report, it targeted 10,000+ organizations in under a year.
Together: not every "extra step" is equally strong.
So what should you pick?
| Who you are | What to do |
|---|---|
| Regular user | Turn on Passkeys first; if you cannot, at least stop reusing one password everywhere |
| Everyday work | Prefer Passkeys (phishing-resistant); keep one usable fallback |
| Sensitive roles / admins | Require phishing resistance: Passkey or a hardware key |
Four common mistakes
| Mistake | Fact |
|---|---|
| "With a code, I am safe from phishing." | Not always. The code can be relayed live. |
| "If the page looks right, it is right." | A fake page can copy the design 1:1. Check the address, not the look. |
| "One-click login is both easier and safer." | The easier it is to hand over, the easier it is to steal. |
| "Passkeys are foolproof." | They fear lost devices, missing cross-device sync, and old sites that do not support them. |
Takeaway
Phishing resistance comes down to one thing: can the thing you use be handed over? If it can, a fake page is dangerous.
(If the account was already stolen: revoke all sessions, sign in again, then switch to something that cannot be handed over.)
These practices come from building Autional, an identity and access management platform — https://www.autional.com
Sources
- NIST, SP 800-63B-4, Digital Identity Guidelines (2025) — phishing resistance.
- W3C, WebAuthn Level 2 (2021); FIDO Alliance, FIDO2 / CTAP2.
- Microsoft Security Blog (2022-07-12), adversary-in-the-middle (AiTM) phishing: password and session theft, MFA bypass.
- Zscaler ThreatLabz (2022-08-02), independent observation of the same AiTM proxy phishing.
