Updated on October 22, 2026 by Whole Technology
Most breaches don’t start with a hacker smashing through a firewall. They start with a convincing email and a login page that looks exactly like the real one.
We see it constantly — including the tax-season phishing campaigns aimed at CPA firms we wrote about earlier this month. A staff member types their password into a fake Microsoft 365 page, approves the MFA prompt or enters the code from their phone, and the attacker is in. The password was strong. MFA was on. It didn’t matter, because phone-based MFA — text codes, authenticator apps, push approvals — can be phished, relayed in real time, or worn down with repeated prompts until someone taps “approve.”
There is a fix, and it’s a small piece of hardware: a YubiKey.
What a YubiKey does differently
A YubiKey is a hardware security key (made by Yubico) that plugs into USB or taps via NFC. It uses the FIDO2/WebAuthn standard, which is where the magic is: the key is cryptographically bound to the real website’s address. If you land on a lookalike phishing page, the key simply won’t respond — there’s nothing to type in, no code to steal, and no prompt to fat-finger. That’s what “phishing-resistant” actually means, and it’s why standards bodies and the FTC Safeguards Rule guidance keep pointing businesses in this direction.
The same key can also hold certificates (PIV/smart card), so one device can cover web logins, Windows sign-in, VPN, and more.
Where YubiKeys work
- Microsoft 365 / Entra ID — phishing-resistant sign-in for email and apps
- Google Workspace
- Windows logon — smart card or FIDO2 sign-in at the desktop
- Password managers — locking the vault itself behind the key
- VPN and remote access — the front door your team uses every day
What we’re doing about it
We’re not just recommending this — we’re adopting it ourselves. Our team is currently completing training through Yubico Academy (the Yubico Essentials and Sales Accelerator programs), we’re rolling YubiKeys out internally first, and then we’ll be deploying them for clients — starting with the firms that attackers target hardest: accounting firms (where the FTC Safeguards Rule and IRS WISP requirements apply) and healthcare and dental practices working under HIPAA.
The pattern we follow with every security control: use it ourselves, learn where it frustrates users and where it saves them, then roll it out with the rough edges already sanded off.
The bottom line
MFA is no longer a yes-or-no question — it’s a which kind question. Codes and push approvals were a big step up from passwords alone, but attackers have caught up. Hardware keys are the step that actually holds.
If your firm’s logins still rely on text codes or push approvals, that’s worth a conversation. Start with our free 27-point IT & security assessment and we’ll map where phishing-resistant MFA fits in your environment.
