Multi-factor authentication (MFA) has long been recognised as one of the most effective safeguards against unauthorised access. As cybercriminals refine their techniques, the Payment Card Industry Data Security Standard (PCI DSS) has also evolved to ensure that authentication controls remain resilient. With the publication of PCI DSS v4.0, the role of MFA is more critical than ever, particularly in safeguarding sensitive cardholder data environments (CDE).
A short but significant question that has emerged from this evolution is whether phishing-resistant authentication methods, such as FIDO2 tokens, WebAuthn, or certificate-based smart cards, are sufficient on their own to satisfy PCI DSS MFA requirements, particularly in the context of requirements 8.4.1 and 8.4.3. While these technologies represent an important advancement in authentication security, PCI DSS makes it clear: they cannot act as the only factor in an MFA process.
Under PCI DSS v4.0, requirements 8.4.1 and 8.4.3 establish specific expectations for MFA:
These controls aim to reduce the risk of unauthorised access by ensuring that a compromise of one authentication method alone is not enough to breach systems that process, store, or transmit cardholder data.
Phishing-resistant authentication solutions are designed to counter one of the most persistent attack vectors: credential theft. Unlike traditional passwords or one-time codes delivered via email or SMS, phishing-resistant technologies are bound cryptographically to the user and device, making them extremely difficult for attackers to intercept or replay.
For example, hardware-based authenticators or biometric-backed FIDO2 tokens do not reveal reusable secrets during the authentication process. This makes them significantly stronger than traditional methods when it comes to preventing phishing-based account compromise.
However, while they provide high assurance against phishing and credential theft, these solutions still only represent one factor in the MFA model.
The principle behind MFA is the diversity of factors. Authentication factors are grouped into three broad categories:
PCI DSS requires that at least two distinct factors be combined to meet MFA obligations. Even if phishing-resistant authentication provides advanced protection, using it alone does not meet the requirement because it falls into a single category of authentication.
In other words, PCI DSS does not allow reliance on one “super-strong” factor, no matter how advanced. The layered approach remains essential, ensuring that even if one factor is compromised or bypassed, an attacker still faces another barrier.
The PCI Security Standards Council (PCI SSC) has clarified that while phishing-resistant authentication is highly recommended and encouraged, it must be used in conjunction with another factor to comply with requirements 8.4.1 and 8.4.3.
For example:
The rationale is rooted in risk management. Even the most resilient authentication methods are not entirely immune to potential exploitation. Hardware could be stolen, biometric data could be spoofed, or device enrolment processes could be manipulated. By requiring multiple factors, PCI DSS ensures stronger resilience in real-world scenarios.
This clarification carries important implications for organisations subject to PCI DSS:
The key takeaway is that PCI DSS compliance is about more than implementing the latest security technology; it is about aligning that technology with a framework designed for layered defence.
While the PCI DSS requirement is regulatory, the principle behind it reflects broader cybersecurity best practice. Attackers are persistent, and no single control is infallible. By enforcing MFA across diverse factors, organisations build resilience that protects not only compliance status but also business continuity and customer trust.
Phishing-resistant authentication should therefore be viewed as a powerful enhancement within the MFA model, not as a standalone solution. Combined with other factors, it significantly strengthens the defensive posture against modern threat actors.
Phishing-resistant authentication represents a significant advancement in securing user access, offering a robust defence against phishing attacks and credential theft. However, under PCI DSS v4.0, it cannot replace the need for multi-factor authentication involving two or more distinct factors.
For requirements 8.4.1 and 8.4.3, MFA remains non-negotiable. Organisations must continue to deploy layered authentication approaches that combine phishing-resistant technologies with additional factors. This ensures compliance while reinforcing a security posture capable of withstanding today’s increasingly sophisticated attack landscape.
Table of Content
