PCI DSS v4.x MFA Requirements Explained: Passkeys, Phishing Resistance, and Compliance

As organizations continue to transition to PCI DSS v.4.x, they encounter updated requirements for authentication, especially considering the emerging phishing-resistant technologies like passkeys. To help clarify these changes, the PCI Security Standards Council has released two key FAQs:  FAQ 1595 and FAQ 1596, offering valuable insights into the use of passkeys, FIDO2-based authentication, and their alignment with multi-factor authentication (MFA) and phishing-resistant protocols.  

In this blog, we’ll unpack the guidance provided in PCI DSS FAQs 1595 and 1596, examine how passkeys and phishing-resistant authentication factors fit into the broader definition of MFA, and outline practical steps to ensure your implementation meets both the technical and security expectations of PCI DSS v4.x. 

What Is Phishing-Resistant Authentication? 

Phishing-resistant authentication is designed to protect against one of the most common and successful attack vectors: credential theft through phishing.  

According to PCI DSS Requirement 8.4.2, phishing-resistant authentication is required for users with:  

• Remote access to the Cardholder Data Environment (CDE) 
• Elevated privileged access to the CDE  

Technologies that support phishing resistance typically include:  

• FIDO2/WebAuthn passkeys 
• Smart cards with PINs 
• Hardware security keys (e.g., YubiKey) 

But not all implementations are created equal. This is where FAQs 1595 and 1596 come into play. 

FAQ 1595: Are Synced Passkeys Acceptable for Phishing-Resistant Authentication? 

The PCI SSC confirms that synced passkeys are acceptable for phishing-resistant authentication, as long as they’re implemented in accordance with FIDO2 standards. 

What Are Synced Passkeys? 

Passkeys are FIDO2/WebAuthn credentials stored on a user’s device and synchronized across multiple trusted devices through cloud-based services (e.g., Apple iCloud Keychain, Google Password Manager, Microsoft Authenticator). Both can be used for authentication with a combination of: 

• Device possession 
• A local unlock mechanism, such as biometrics or a PIN 

FAQ 1595 Clarifies: 

Synced passwords can meet Requirement 8.4.2 if: 

• The private key is securely stored and non-exportable
• Authentication is bound to a trusted device 
• Replay and phishing attacks are mitigated 
• Strong device-level protections are enforced: 
  • Biometric (Fingerprint, Face ID) 
  • Trusted Platform Module (TPM) or Trusted Execution Environment (TEE) 
  • Full disk encryption (BitLocker, FileVault) 
  • Mobile Device Management (MDM) 

In short: Passkeys can fulfill phishing-resistant requirements under 8.4.2, organizations must also consider where such solutions satisfy broader multi-factor authentication requirements under 8.4.1 and 8.4.3, which brings us to FAQ 1596. 

FAQ 1596: Is Phishing-Resistant Authentication Alone Enough to Satisfy MFA?  

The PCI SSC states that phishing-resistant authentication can satisfy MFA alone,   but only if the phishing-resistant authentication method meets the full PCI DSS definition of MFA. 

FAQ 1596 Explains: 

Phishing-resistant methods, such as passkeys, may include two factors in one interaction (e.g., unlocking a passkey with biometrics on a secured device). This can satisfy PCI DSS Requirements 8.4.1 and 8.4.3 for MFA if: 

• The cryptographic authentication is bound to a secure device 
• The unlocking factor (e.g., biometric or PIN) is stored locally and never shared 
• The implementation ensures both factor separation and resilience to phishing 

To truly determine whether your phishing-resistant method qualifies as MFA under PCI DSS, it’s essential to understand how the Council defines multi-factor authentication and what a compliant implementation looks like. 

What Does PCI DSS Really Require for MFA? 

To meet PCI DSS requirements, MFA must include two or more distinct authentication factors, chosen from different categories: 

1. Something you know: password or passphrase 
2. Something you have: smartphone, hardware token, smart card 
3. Something you are: fingerprint, facial recognition, retina scan 

Each factor must be: 

• Independent: compromise of one does not affect the others 
• Resistant to replay: credentials can't be intercepted and reused 
• Securely implemented: no storage of secrets in plaintext, no insecure fallback 

It’s important to note that simply having two steps is not enough if both steps are from the same category (e.g, password + security question). 

How MFA Is Typically Implemented 

Here are some compliant MFA configurations, and what makes them secure: 

Strengthening MFA to Meet PCI DSS and FAQ Guidance 

To ensure your MFA implementation aligns with the intent of PCI DSS and addresses FAQs 1595 and 1596, consider the following: 

Key Considerations for Meeting PCI DSS v4.x MFA Requirements 

As organizations modernize their authentication strategies, technologies like passkeys, biometrics, and hardware tokens offer a powerful combination of security and user experience. But as PCI DSS FAQs 1595 and 1596 clarify, compliance is not just about using modern tools, it’s about how you implement and secure them. 

If you’re exploring passkeys, FIDO2/WebAuthn, or other emerging authentication technologies, now is the time to assess: 

• Does your solution meet the PCI definition of MFA? 
• Are your phishing-resistant credentials cryptographically bound and non-exportable?
• Do you have visibility and logging in place for compliance verification? 

PCI DSS v4.x allows flexibility, but only if the security outcomes are maintained. That means carefully designing your authentication flows to ensure both technical compliance and real-world security. If you have any additional questions about meeting PCI DSS v4.x validation or requirements, Schellman can help. Contact us today to learn more. 

In the meantime, discover additional PCI validation insights in these helpful resources:  

• Important PCI DSS v4.0.1 Update for E-commerce Merchants 
• How to Navigate PCI DSS Third-Party Service Provider Requirements 
• What you Need to Know About the PCI DSS Customized Approach