Protecting company accounts is not just "turning on MFA"; the method matters. SMS codes and authenticator app codes are far better than a password alone, but a well-built phishing site can capture them. Push notifications with number matching stop MFA fatigue attacks, while FIDO2 security keys and passkeys are phishing-resistant because the credential is cryptographically bound to the legitimate domain. The SMB playbook: a password manager, single sign-on, MFA for everyone, passkeys or hardware keys for admins, and an account recovery process as strict as the login itself.
Why accounts are the main target
Year after year, the Verizon Data Breach Investigations Report (DBIR) ranks stolen credentials and phishing among the most common initial access vectors in the breaches it analyzes. The economics are simple: logging in with a valid username and password is cheaper and quieter than exploiting a vulnerability, and it looks legitimate in the logs.
Attackers get credentials in several ways:
- Password reuse: a password leaked in another company's breach gets sprayed against your email, VPN or CRM automatically.
- Phishing: fake login pages that generative AI has made far more convincing. See our guide on AI phishing and deepfakes.
- Infostealer malware: malware that harvests saved browser passwords and session cookies, often from an employee's personal computer.
- Access brokers: middlemen who sell valid credentials and sessions to ransomware crews.
One compromised mailbox is enough for business email compromise and vendor payment fraud, for resetting passwords on other services, or for launching a ransomware attack. That is why account protection is phase one of any Zero Trust roadmap for SMBs.
What MFA is, and why methods are not equal
Multi-factor authentication (MFA) requires two or more different kinds of factors to sign in: something you know (a password), something you have (a phone or security key) or something you are (a fingerprint or face). Any MFA dramatically cuts automated attacks using leaked passwords. Against targeted phishing, though, the differences between methods are huge.
The reason is adversary-in-the-middle (AiTM) phishing kits. A fake site sits between the victim and the real service, relays the password and one-time code in real time, and keeps the resulting session cookie. As far as the service can tell, the login was valid and passed MFA. Only methods cryptographically bound to the legitimate domain defeat this.
| Method | How it works | Phishing-resistant? | Main risk |
|---|---|---|---|
| SMS or voice call | Code sent to a phone number | No | SIM swapping, interception, real-time phishing. NIST SP 800-63B classifies it as a restricted authenticator |
| TOTP app code (Google Authenticator, Microsoft Authenticator and similar) | Six-digit code that rotates every 30 seconds | No | Users can type the code into a fake site |
| Simple push (approve/deny) | Notification in a phone app | No | MFA fatigue: users approve out of annoyance or by mistake |
| Push with number matching | User types the number shown on the login screen into the app | No, but stops fatigue attacks | Still exposed to a well-run AiTM phishing kit |
| FIDO2 security keys and passkeys | Domain-bound cryptographic signature, unlocked with PIN or biometrics | Yes | Account recovery and lost devices, if not planned for |
The practical takeaway: any MFA beats none, an authenticator app with number matching is a solid floor for all staff, and FIDO2 methods should be mandatory for admins and anyone who can move money or reach sensitive data. CISA urges every organization to make phishing-resistant MFA the goal.
What is an MFA fatigue attack?
An MFA fatigue attack (also called push bombing) is when an attacker who already has the victim's password fires off a stream of push approval requests until the person accepts one out of frustration, by accident, or because someone posing as IT support asks them to. It featured in widely reported intrusions, including the 2022 Uber breach.
How to defend against it:
- Enable number matching for push approvals. Microsoft Authenticator enforces it by default, and most identity providers offer it.
- Show context in the prompt: app, approximate location and device.
- Rate-limit prompts and alert security on bursts of denied requests.
- Teach one simple rule: an approval request you did not start means someone has your password. Deny it and report it.
- Move critical accounts to passkeys or FIDO2 keys, which do not rely on anyone tapping "approve."
Passkeys explained
A passkey is a sign-in credential based on public-key cryptography, defined by the FIDO2 standards, that replaces the password: the device holds a private key that never leaves it, and the service only stores the matching public key. FIDO2 combines two specifications: WebAuthn, the W3C standard that browsers and websites use, and CTAP, the FIDO Alliance protocol for talking to external authenticators such as a USB key or a phone.
At sign-in, the service sends a challenge, your device asks for your fingerprint, face or PIN to unlock the key, and it signs the challenge. Three properties make this so strong:
- Domain-bound: a passkey for yourcompany.com does not work on yourcompany-login.com. A phishing site simply never gets a valid signature.
- Nothing reusable to steal: the server stores no shared secrets, so a database breach exposes no usable credentials.
- Biometrics stay on the device: your fingerprint or face only unlocks the key locally; it is never sent to the service.
There are two kinds of passkeys, and you should choose deliberately:
| Type | Where it lives | Strengths | Use it for |
|---|---|---|---|
| Synced | In the platform credential manager or a password manager (iCloud Keychain, Google Password Manager, 1Password, Bitwarden and others), synced across devices | Convenient; survives a lost phone | Most employees and your customers |
| Device-bound | On a hardware security key (such as a YubiKey) or a device's secure chip, and cannot be copied | Maximum control: the credential never leaves the hardware | Admins, finance and cloud accounts |
Password managers and SSO complete the picture
As long as passwords exist, you need a business password manager. It generates long, unique passwords for every service, lets teams share credentials without pasting them into chat, and flags passwords that show up in breaches. It also only autofills on the correct domain, which is itself a phishing defense.
The password guidance in the latest revision of NIST SP 800-63B points the same way: favor length, drop arbitrary composition rules and forced periodic changes, and check new passwords against lists of known-compromised ones.
Single sign-on (SSO) attacks the problem at the root. Staff authenticate once, with strong MFA, at the identity provider (Microsoft Entra ID, Google Workspace, Okta) and get into every other app from there. Fewer passwords to steal, one place to require passkeys, and offboarding becomes disabling a single account.
Admin and privileged accounts
A compromised admin account is a major incident, so it gets its own rules:
- Separate admin accounts from everyday accounts, with no email or web browsing.
- Mandatory phishing-resistant MFA with two security keys per person: one for daily use and a backup stored somewhere safe.
- Break-glass emergency accounts with strong credentials stored offline and alerts every time they are used.
- Do not forget the "invisible" accounts: the cloud root account, domain registrar, DNS, online banking, brand social media and vendor consoles. Whoever controls your DNS controls your email. For AWS, our hardening checklist covers locking down the root user.
- Shared accounts only inside the password manager, with an audit trail of who used them, never in a spreadsheet.
The weak link: account recovery
A passkey does little if an attacker can call your help desk, claim they lost their phone and get MFA reset. Groups such as Scattered Spider, the subject of a joint CISA and FBI advisory, combine help desk social engineering, MFA fatigue and SIM swapping specifically to get around strong controls.
To close that door:
- Real identity verification before any MFA reset: a video call with ID, confirmation from the person's manager, and a callback to a number already on file, never the one the caller provides.
- No resets via SMS or personal email for privileged accounts.
- Recovery codes stored in the password manager, not on a sticky note.
- Automatic alerts to the user and to security whenever an MFA method is added or removed.
- A waiting period or dual approval for resetting admin MFA.
Build these scenarios into your incident response plan: what to do when an account takeover is suspected, how to revoke active sessions, and who makes the call.
Rollout plan for an SMB
- Inventory: list your apps, who uses them, which support SSO and passkeys, and which accounts are privileged.
- Admins first: buy security keys (two per person) and require phishing-resistant methods at the identity provider, cloud, domain registrar and bank.
- A password manager for everyone, with a short training session and migration of shared credentials.
- MFA required for all staff, with an authenticator app and number matching as the floor and passkeys as the recommended option. Block legacy authentication that cannot do MFA.
- SSO for business apps, starting with the ones that handle customer data or money.
- A recovery procedure written down and rehearsed with the help desk, including your managed service provider if IT is outsourced.
- Metrics: share of accounts with MFA, share on phishing-resistant methods, active exceptions and MFA resets per month. Review quarterly.
Announce the change before you enforce it, offer hands-on support for the first few weeks, and avoid permanent exceptions: the one account left without MFA is exactly the one attackers will find. Cyber insurers and enterprise customers increasingly ask about MFA coverage in their questionnaires, so these numbers do double duty.
Building a product? How to add passkeys
If your company runs an app or platform with its own users, offering passkeys improves your customers' security and usually makes sign-in faster. The essentials of a WebAuthn implementation:
- Do not hand-roll the crypto. Use a well-maintained server library such as SimpleWebAuthn for Node.js, py_webauthn for Python or java-webauthn-server for Java.
- Registration: the server issues a random, single-use challenge and the browser calls
navigator.credentials.create(). Store the credential ID, public key, signature counter and owning user. Allow multiple passkeys per account. - Authentication: a fresh challenge,
navigator.credentials.get()in the browser, and server-side verification of the signature, origin and relying party ID (RP ID, usually your domain). - Conditional UI: with
mediation: 'conditional', the browser offers the passkey in the username field's autofill, which helps adoption a lot. - Mobile apps: use Credential Manager on Android and the AuthenticationServices framework on iOS, and associate the app with your domain (Digital Asset Links and Associated Domains) so the same passkey works on web and mobile. See also our mobile app security guide.
- Recovery: your recovery flow becomes the new attack target; protect it with step-up verification, rate limits and user notifications.
- APIs and sessions: a passkey protects the login, not what comes after. Short-lived tokens, session revocation and authorization checks still matter, as our API security guide explains.
passkeys.dev, maintained by people from the FIDO Alliance and W3C communities, collects implementation guides and platform support details. Before launch, a penetration test focused on authentication and account recovery will surface the shortcuts an attacker would try first.
Frequently asked questions
Is SMS-based MFA still worth using?
Yes, compared with no MFA at all. It blocks most automated attacks with leaked passwords. But it is vulnerable to SIM swapping and real-time phishing, and NIST classifies it as a restricted authenticator. Treat it as a stepping stone or last-resort fallback, and never use it for admins or accounts that can move money.
What is the difference between a passkey and a security key?
Both use the FIDO2 standards and both resist phishing. A synced passkey lives in your credential manager and copies across your devices; a hardware security key keeps the credential on the device itself, where it cannot be copied. Hardware keys give you more control and are the recommended choice for admins; synced passkeys are more convenient for everyone else.
What happens if an employee loses the phone that holds their passkeys?
Synced passkeys come back when the employee signs in to their platform account or password manager on a new device. For device-bound credentials, they use their backup key or go through the company's recovery process. That is why you should register at least two authenticators per person and have an identity-verified recovery procedure.
Will passkeys fully replace passwords?
They can on services that support them, and that is the FIDO Alliance's stated goal. In practice, many companies keep long passwords stored in a password manager as a fallback during the transition. What matters is that your primary sign-in method and your recovery method are equally strong.
How much does MFA cost for a small business?
Basic MFA is included in Microsoft 365, Google Workspace and most cloud services. The usual extra costs are security keys for admins, a business password manager, and time for setup and training. It is consistently one of the security investments with the best ratio of cost to risk reduced.
Conclusion
Securing company accounts is the highest-impact security move per dollar spent. Turn on MFA for everyone, raise the floor with number matching, require passkeys or FIDO2 keys for admins, add a password manager and SSO, and treat account recovery as seriously as sign-in. If you build software, offering passkeys to your customers is now standard practice.
MisterProSoft is a nearshore security and engineering team working in UTC-5, the same business hours as US Eastern and Central time. We set up phishing-resistant MFA, SSO and access policies on Microsoft 365, Google Workspace or your cloud, harden recovery processes, and add passkeys to your applications. Explore our cybersecurity services or book a free consultation.
