---
schema_version: "1"
id: f5b57472f2bed8f982460c359268eba3d3db6009aecde1c7ca8caad69febde33
title: Use Phishing-Resistant Verification Methods for Multi-Factor Authentication
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/262-0-0/rn_b2c_phishing_resistant_mfa_verifiers.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_b2c_phishing_resistant_mfa_verifiers.htm&release=262.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: 00dc5332e7f3a0e44e22a6c4798f8c02e77a4bc273d4154b65c64801b3549db8
description: Account Manager now supports additional phishing-resistant verification methods, including passkeys, security keys, and built-in platform biometric authenticators such as Touch ID, Face ID, and Windows Hello. After you enable phishing-resistant methods on the organization detail page, Account Manager users can register those methods and use them at login. Phishing-resistant methods use FIDO2/WebAuthn to bind credentials to Account Manager, so attackers can't reuse them on a spoofed site. We highly recommend that Admin users register with one of the phishing-resistant verification methods.
products:
  - Cross Cloud
release: "262"
---
# Use Phishing-Resistant Verification Methods for Multi-Factor Authentication

Account Manager now supports additional phishing-resistant verification methods, including passkeys, security keys, and built-in platform biometric authenticators such as Touch ID, Face ID, and Windows Hello. After you enable phishing-resistant methods on the organization detail page, Account Manager users can register those methods and use them at login. Phishing-resistant methods use FIDO2/WebAuthn to bind credentials to Account Manager, so attackers can't reuse them on a spoofed site. We highly recommend that Admin users register with one of the phishing-resistant verification methods.

**Where:** This change applies to Account Manager for B2C Commerce.

**How:** From your organization detail page, select the phishing-resistant verification methods that you want to allow. Users see the newly allowed methods when they register a verification method or add one from their account information.

![MFA Verification Method Settings on the organization detail page, showing Phishing-Resistant Verification Methods (Built-In Authenticator, WebAuthn-Compliant Security Keys) and Standard Verification Methods (Salesforce Authenticator, TOTP Authenticator Apps).](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-release-notes-salesforce_release_notes-262-0-0-production-enus/e945111b-3e0a-4011-accc-d5949363bfcc/salesforce_release_notes/images/commerce/b2c_rn_phishing_resistant_mfa_verifiers.png)

#### See Also

- [_Salesforce Help_: Register Verification Methods for Multi-Factor Authentication in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_account_manager_register_verification_methods_for_mfa.htm&language=en_US)
- [_Salesforce Help_: Verify Your Identity with Multi-Factor Authentication in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_account_manager_verify_with_mfa.htm&language=en_US)
- [_Salesforce Help_: Register a Passkey for Identity Verification in B2C Commerce (can be outdated or unavailable during release preview)](https://help.salesforce.com/s/articleView?id=cc.b2c_account_manager_register_a_passkey_for_identity_verification.htm&language=en_US)
- [_Salesforce Help_: Register a Security Key for WebAuthn Identity Verification in B2C Commerce](https://help.salesforce.com/s/articleView?id=cc.b2c_account_manager_register_a_security_key_for_webauthn_identity_verification.htm&language=en_US)