Definition
Phishing-resistant MFA is multi-factor authentication that cannot be relayed by an attacker via a fake login page — typically achieved through cryptographic origin binding (FIDO2 / WebAuthn / passkeys) or certificate-based authentication (PIV / smart cards).
Most "ordinary" MFA factors (SMS, OTP, push) are vulnerable to real-time phishing: an attacker stands up a fake login page, captures the user's credentials + OTP, and replays them to the real site. Phishing-resistant MFA defeats this because the credential is cryptographically bound to the legitimate origin and cannot be reused against a different origin.
NIST 800-63B explicitly defines phishing-resistant authentication at AAL3. OMB M-22-09 (2022) requires phishing-resistant MFA for federal workforce. The expectation is spreading to private sector privileged accounts.