What Is the Best Phishing-Resistant Login for Wealth Management Firms?
For most small wealth management firms, the best phishing-resistant login is a passkey or a hardware security key built on the FIDO2 standard, enforced for every user in Microsoft 365. Unlike text message codes or "approve this sign-in" push prompts, these logins are tied to your real website address, so a fake login page can't capture them and replay them.
If your team still signs in with a password plus a texted code, you have MFA, but not the kind that stops today's phishing kits. Here's the difference, what to turn on in Microsoft 365, and a rollout a small RIA can manage.
Why isn't regular MFA enough for an advisory firm anymore?
Regular MFA stops someone who only has your password. Modern phishing goes further. An attacker sends a convincing email, such as a custodian alert or a "client file shared with you" notice, that leads to a fake Microsoft 365 sign-in page. The user types the password and code, or taps approve, and the attacker's tool relays it all to Microsoft and keeps the signed-in session.
From there, the attacker reads the mailbox and waits to send altered wire instructions. See how wealth management firms stop wire fraud before the money moves.
Device code phishing skips the fake page entirely and tricks a user into entering a code on a real Microsoft page. We explain it in why MFA alone isn't enough against device code phishing.
What makes a login "phishing-resistant"?
A login is phishing-resistant when there is nothing for the user to type or approve that an attacker can reuse. Passkeys and hardware security keys work this way:
The key is bound to the real website. A look-alike domain gets nothing.
There's no code to read aloud or forward. The secret never leaves the device.
The user proves presence locally. A fingerprint, face scan, device PIN or a touch on the key confirms it's really them.
How do the common login methods compare?
Method | Stops fake login pages? | Notes for a small firm |
|---|---|---|
Text message (SMS) code | No | Codes can be phished; numbers can be SIM-swapped |
Authenticator app push (simple approve) | No | Users can approve prompts just to make them stop |
Push with number matching | Partly | Stops blind approvals, but can still be relayed |
Passkey on phone or laptop | Yes | Easy daily use with fingerprint or face |
Hardware security key (FIDO2) | Yes | Best for admins and anyone who moves money |
Certificate-based sign-in on managed devices | Yes | Works when every device is firm-managed |
What is number matching, and is it good enough?
Number matching shows a number on the sign-in screen that the user types into their authenticator app. It stops people from approving prompts they didn't start, and Microsoft 365 uses it by default for push sign-ins.
It still isn't phishing-resistant: a fake page can show the user the real number. Treat it as a stepping stone, not the finish line.
Should we use passkeys or hardware security keys?
Most firms end up using both:
Passkeys for everyday staff. A passkey in an authenticator app or built into a firm-managed laptop lets advisors sign in with a fingerprint or face.
Hardware security keys for high-risk roles. Give keys, plus a stored backup, to administrators, principals, the CCO, and anyone who can change wire instructions.
Choose keys and devices that follow the FIDO2 standard.
How do we require phishing-resistant MFA in Microsoft 365?
The controls live in the identity settings of your Microsoft 365 tenant. In general terms:
Turn on the phishing-resistant methods you plan to use, such as passkeys (FIDO2) and, if relevant, certificate-based sign-in.
Create a Conditional Access policy that requires the built-in "phishing-resistant MFA" authentication strength. Start with administrators, then expand to all staff.
Block legacy sign-in methods that can't do MFA at all, such as older email protocols.
Restrict device code sign-in unless you have a specific need for it.
Require a firm-managed device for email, files and client systems, so a stolen session on an unknown laptop is less useful.
Keep two break-glass admin accounts with hardware keys, excluded only from the policies that could lock you out, and monitored closely.
Pair strong logins with monitoring. Our identity threat detection and response service watches for risky sign-ins and suspicious mailbox rules.
What's a realistic rollout plan for a small RIA?
For a firm of a handful to a few dozen people, a phased rollout keeps disruption low:
Inventory. List every user, device, and system they sign into, including CRM and custodian portals.
Protect admins first. Enroll administrators and principals with hardware security keys and turn on the Conditional Access policy for them.
Pilot. Start with one advisor and one operations person.
Enroll everyone. Use short hands-on sessions and register two methods per person.
Enforce. Expand the policy to all users and remove SMS and simple push as allowed methods.
Write down recovery. Decide how someone who loses a phone or key proves who they are. Impersonators target this step.
Review regularly. Check sign-in reports, new devices, hires and departures.
Many custodian and financial portals now support passkeys too. Turn them on wherever offered.
What do regulators and examiners expect?
Regulators don't name a login product, but they expect you to protect client information and show how. The SEC's amended Regulation S-P calls for written safeguards, an incident response program, and notice to affected people after certain breaches. Colorado and Texas securities regulators ask state-registered advisers similar questions.
In practice, examiners tend to ask:
How do staff sign in to systems that hold client data?
Is MFA required for everyone, including remote access and email?
How do you handle lost devices and departing employees?
Phishing-resistant MFA, a written policy and sign-in records give clear answers. For more, see what SEC examiners ask your IT provider, and our IT and cybersecurity for financial services firms page.
Frequently asked questions
Is text message MFA still acceptable for a wealth management firm?
It beats a password alone, but it isn't phishing-resistant. Use it only as a temporary step while you move staff to passkeys or hardware security keys.
Are passkeys safe if an advisor loses their phone?
Yes. A passkey can't be used without the phone's own fingerprint, face or PIN unlock. Remove the lost device, confirm the user's identity, and re-enroll them on a new one.
Do we need hardware security keys for every employee?
Not necessarily. Many small firms use passkeys for most staff and hardware security keys for administrators and anyone who can move money.
Does phishing-resistant MFA stop wire fraud on its own?
No. It closes the most common way attackers get into a mailbox, but you still need call-back verification on a known phone number before any change to payment instructions, plus monitoring for suspicious sign-ins and mailbox rules.
Will phishing-resistant MFA satisfy SEC examiners?
No single control does that. Examiners look at your written policies and whether you can show your controls are in place. Phishing-resistant MFA is a strong, easy-to-explain part of that picture.
Ready to move your firm to phishing-resistant logins?
24uNet has helped small businesses in Denver and Bryan–College Station since 2004. We can review how your team signs in, set up passkeys, hardware keys and Conditional Access in Microsoft 365, and walk staff through enrollment.
Denver: (303) 468-5515
College Station: (979) 256-5100
Email: sales@24unet.com
Or contact us.
ABOUT THE AUTHOR
Dane Gray — Cofounder, 24uNet. 30+ years in IT and cybersecurity. CMMC-AB Registered Practitioner, CompTIA Security+, CEH. Texas A&M '91. Dane Gray on LinkedIn.
Comments