Ranking MFA Methods – From Least to Most Secure

**Executive Summary:** This blog post evaluates and ranks common MFA methods (SMS/voice OTP, app-based OTP, push notifications, hardware security keys, and passkeys/FIDO2), discusses attack vectors like phishing, SIM swapping, MFA fatigue and SS7/AiTM techniques, and offers best-practice recommendations such as monitoring authentication logs, enforcing phishing-resistant MFA, and deploying adaptive/conditional access controls.