NIST SP 800-63B-4 says applications assessed at AAL2 must offer a phishing-resistant authentication option. This is a standards briefing, not a claim that a new rule appeared today or that every private service is legally bound by NIST.

A one-time code can be relayed from a convincing fake page. Ask a service which exact method resists phishing and whether it is available on every account type you plan to use. A marketing label such as “two-factor” is not enough to answer that question.

Look at enrolment and recovery too: a strong daily sign-in loses value if a lost-device fallback bypasses it. Check whether you can register more than one authenticator, remove a lost one and review account activity without giving support staff an unsafe shortcut.

For procurement, record the supported method, device compatibility, recovery steps and administrative policy separately. NIST defines assurance levels for its scope; treat them as a useful comparison framework rather than a blanket legal certification for a consumer app.