Why the weaker factor is still phishable
A real-time phishing proxy can relay a one-time code or push approval from a victim to the real login page within the code's valid window, defeating the second factor entirely without needing to break any cryptography — a well-documented, actively used attack pattern.
Phishing-resistant methods close this specific gap because the cryptographic challenge is bound to the legitimate origin; a relay attack has nothing to forward that would validate.
What actually blocks faster adoption
Legacy applications without modern authentication support, device provisioning logistics for a distributed workforce, and the perceived cost of hardware keys are the real blockers — all solvable with a phased rollout prioritising the highest-risk accounts first, rather than requiring an all-or-nothing migration.
The better factor isn't missing. The rollout plan is. Start with the accounts that would hurt most if phished.MNB Security Practice
Key actions
- Prioritise phishing-resistant MFA for the highest-risk accounts first
- Identify legacy applications blocking modern authentication support
- Phase the rollout rather than requiring an all-or-nothing migration
- Retire SMS/app-based codes as the sole factor once resistant options are viable