Require a phishing-resistant method first, which means passkeys or hardware security keys. Allow an authenticator app (TOTP) as the next tier, and treat SMS as a last resort. The order follows how well each method survives a user being tricked on a fake login page.
The four options, ranked
Passkeys and security keys. Cryptographic and bound to the real site, so a phishing page cannot replay them. NIST lists WebAuthn as an example of verifier name binding, one of its two recognised ways to get phishing resistance.
TOTP apps. The code is a six digit number the user types. It resists password reuse attacks, but a user can be tricked into typing it into a fake page, and NIST says manual entry of an authenticator output is not phishing resistant.
Push approvals. Convenient, but open to prompt flooding unless you add number matching. See push fatigue and number matching.
SMS or voice codes. NIST classes PSTN delivery as restricted. The OWASP MFA cheat sheet lists SIM swapping, number porting, SS7 interception and codes read from a locked screen among the risks. More in why SMS codes are weak.
A practical policy by audience
- Admins and anyone with production access: passkey or security key, no downgrade.
- All employees: passkey where devices support it, TOTP as an allowed fallback.
- Customers of your product: offer passkeys and TOTP, keep SMS only if your users have nothing else, and say so in your threat model.
- Contractors on unmanaged devices: security keys are often easier to reason about than syncing credentials across personal devices.
Do not let the fallback undo the choice
OWASP says a fallback must not be weaker than the primary method and recommends blocking downgrades from phishing-resistant authenticators unless a documented policy requires it. If a user with a security key can reset into SMS, an attacker only needs the SMS path.
Roll out in this order
- Require MFA for admins and for any account that can change billing, SSO or secrets.
- Turn on passkeys as an option and track enrollment.
- Remove SMS for staff accounts once most have a stronger method.
- Review recovery paths. See MFA recovery and fallback.
One more point on measurement. Track enrollment by method, and track how many sign-ins still use the weakest method you allow. That number tells you whether your ranking is working in practice. If most staff still choose the fallback, the enrollment screen is probably hiding the better options, or the better options do not work on their devices. Fix that before you tighten the policy.
Quick check
Is any MFA better than none?
Yes. OWASP calls MFA the best defense against most password-based attacks. The ranking only matters once you can choose.
Do I need hardware keys for everyone?
Usually not. Start with admins and high-privilege roles, and use passkeys or TOTP elsewhere.
Sources
- NIST SP 800-63B-4
- OWASP Multifactor Authentication Cheat Sheet
- OWASP Credential Stuffing Prevention Cheat Sheet
Last reviewed: 19 October 2026.
