Essential Eight MF-ML2.4Offer customers a phishing-resistant multi-factor authentication option for online customer services
Official control statement
Multi-factor authentication used for authenticating customers of online customer services provides a phishing-resistant option.
Quoted as published. Everything else on this page is written by Control Stack.
In plain English
Let customers who use multi-factor sign-in on your online services choose a method, such as a passkey or security key, that a fake login page cannot capture and reuse.
What this means in practice
When customers sign in to your online customer services (such as a customer portal, online account or mobile app) with multi-factor authentication, at least one of the sign-in methods you offer them must be phishing-resistant. Common second steps, such as codes sent by text message or email, codes from an authenticator app, or a prompt asking the customer to approve a sign-in, can all be defeated by a convincing fake login page that relays the customer's sign-in to a criminal as it happens. Passkeys (sign-in keys stored on a phone or computer and unlocked with a fingerprint, face or PIN) and physical security keys only work on your genuine website, so they still protect customers who are fooled by a look-alike site. Other methods can stay available, but customers must be able to choose the phishing-resistant one, which helps stop their accounts, and the information in them, from being taken over.
Framework
ASD Essential Eight
Control effect (Control Stack)
Preventative
E8 mitigation strategy
Multi-factor authentication
Classifications
N/A
Official last update
N/A
Control Stack last updated
15 Oct 2026
E8 maturity levels
N/A
Why it matters
Without a phishing-resistant choice, customers stay exposed to fake login pages that capture their passwords and codes, letting criminals take over accounts and misuse customer information.
Operational notes
After each release, re-test customer set-up and sign-in with the phishing-resistant method on every sign-in channel, and add new online customer services to the check before they go live.
Implementation tips
- The IT manager should list every online customer service where customers sign in with multi-factor authentication, such as customer portals, online accounts and mobile apps, whether built in-house or run on a vendor's platform. For each one, record the sign-in methods currently offered to customers and note whether any of them is phishing-resistant, so the services that still lack the option are obvious.
- The development team, or the vendor for a hosted service, should add passkey or physical security key sign-in based on the FIDO2 and WebAuthn standards (the open standards behind passkeys) to every service that lacks a phishing-resistant method. Tie each credential to the service's genuine web address so it cannot be used on a look-alike site, and do not treat codes sent by text message or email, authenticator app codes or sign-in approval prompts as the phishing-resistant option, because a fake site can relay all of them.
- The product owner for each service should make the phishing-resistant option easy for customers to find and turn on, for example in the account security settings and as a choice whenever a customer sets up multi-factor authentication. Use plain wording on those screens and in the help pages to explain that a passkey or security key keeps the account safe even if the customer is tricked by a fake website.
- The test team should make sure the option works on every way customers sign in to the service, such as the website and the mobile app, and on the common phones, computers and browsers customers use. Add setting up and signing in with the phishing-resistant method to the tests run before each release, so an update cannot quietly break or remove it.
- The security officer should keep a record of the phishing-resistant option offered on each online customer service and when it was last tested, and update it whenever a customer service is added or its sign-in platform changes. For vendor-hosted services, write support for the phishing-resistant option into the contract or service requirements so a vendor change does not take it away.
Audit / evidence tips
- AskRequest the register of online customer services that authenticate customers with multi-factor authentication, listing the sign-in methods each one offers.Look atWhether every service in the register, including any run on a vendor's platform, shows at least one phishing-resistant method rather than only text message, email or app codes.GoodEvery online customer service that uses multi-factor authentication for customers offers a phishing-resistant method that customers can choose today.
- AskRequest the technical description or vendor specification of the method the organisation counts as its phishing-resistant option.Look atWhether it is a method a fake website cannot capture and relay, such as a passkey, physical security key or smart card, rather than a one-time code or a sign-in approval prompt.GoodThe option is a genuinely phishing-resistant method, not a code or approval prompt that has simply been labelled as phishing-resistant.
- AskRequest screenshots or an export of the customer sign-in platform's authentication method settings for each in-scope service.Look atWhether the phishing-resistant method is switched on for customer accounts, not only for staff accounts or a small pilot group.GoodThe settings show the phishing-resistant method enabled for the customers of every in-scope service.
- AskAsk the service owner to demonstrate a test customer account setting up a passkey or security key and then signing in with it.Look atWhether the option can be found in the customer's own account settings and works on each way customers sign in, such as the website and the mobile app.GoodThe test customer sets up the phishing-resistant method and signs in with it successfully on every sign-in channel the service offers.
- AskRequest the customer help pages and the sign-up and account security screens that describe multi-factor sign-in choices.Look atWhether customers are told that the phishing-resistant option exists and how to turn it on.GoodCustomer-facing screens and help content show the phishing-resistant option with clear set-up steps, so customers can actually choose it.
Cross-framework mappings
How E8-MF-ML2.4 relates to controls across ISO/IEC 27001, ISO/IEC 42001, Essential Eight, and ASD ISM.
ISO 27001
| Control | Notes | Details |
|---|---|---|
layersPartially meets(1)expand_less | ||
| Annex A 8.5 | E8-MF-ML2.4 requires that multi-factor authentication for customers of online customer services offers a phishing-resistant option, while... | |
ASD ISM
| Control | Notes | Details |
|---|---|---|
equalEquivalent(1)expand_less | ||
| ISM-1873 | E8-MF-ML2.4 and ISM-1873 both require that multi-factor authentication used for authenticating customers of online customer services prov... | |
layersPartially meets(1)expand_less | ||
| ISM-1874 | E8-MF-ML2.4 requires that multi-factor authentication for customers of online customer services offers at least one phishing-resistant op... | |
extensionDepends on(1)expand_less | ||
| ISM-1681 | E8-MF-ML2.4 requires that multi-factor authentication used for customers of online customer services offers a phishing-resistant option, ... | |
These mappings show relationships between controls across frameworks. They do not imply full equivalence or certification.
Related Essential 8 controls in Multi-factor authentication
See all Multi-factor authentication controls, or browse the full ASD Essential Eight library.