Phishing-Resistant Authentication
PCIComplianceHubLast updated
Authentication that cannot be defeated by tricking a user into handing over a credential or approving a prompt, because the secret is never disclosed to any party other than the legitimate system, typically through a factor cryptographically bound to that system. FIDO2 is the Council's example. Passwords, one-time passwords, SMS codes and magic links are not phishing-resistant, because a user can be induced to type or relay them into an attacker's page. PCI DSS v4.0.1 gives the term one job: a user account authenticated only with phishing-resistant factors is excluded from the MFA that 8.4.2 otherwise requires for non-console access into the Cardholder Data Environment.
Applies to. It applies to the authentication factors an entity chooses, and the standard attaches a consequence to the choice: the applicability note under 8.4.2 says that requirement does not apply to user accounts that are only authenticated with phishing-resistant authentication factors, alongside its exclusions for automated system accounts and single-transaction point-of-sale accounts. 8.5.1 still governs any MFA system the entity runs, requiring two different factor types, success on every factor and resistance to replay attacks; its text does not name phishing resistance, so whether a chosen factor resists phishing is a property of that factor rather than a condition 8.5.1 spells out.
Example. A merchant's administrators used to approve a prompt on their phones after typing a password, and an attacker who had phished the password could send prompts until one was approved. The merchant replaces the prompt with a hardware security key registered to the admin console's own web address; a look-alike login page cannot complete the key's challenge because the key only answers for the real site.
Limits. Phishing resistance is a property of the factor, not a consequence of having two of them: a password plus an SMS code meets 8.5.1's two-type rule and is still not phishing-resistant, because both secrets can be typed into an attacker's page. It is not the same as replay resistance, which 8.5.1 does require: a one-time code that expires quickly resists replay yet can be phished within its window. Magic links sent by email sit on the same side as SMS codes and OTPs, not resistant. And it protects the login only; a phishing email that carries malware or asks for a payment is beyond what any authentication method can stop.
In PCI DSS v4.0.1. 8.4.2