MFA Support Directory: YubiKey, Authenticator Apps & Passkeys

Most products advertise “MFA.” Far fewer document options customers can actually enroll that resist SIM-swap: a YubiKey-class FIDO security key, an open authenticator-app TOTP path (Google Authenticator, Proton Pass, and peers), or passkeys (platform or synced WebAuthn credentials).

This living directory tracks all three methods and includes:

1. Supporters — businesses with documented YubiKey/FIDO and/or open TOTP (Strong / Pass)
2. Passkey-capable services — rows with a documented consumer passkey enrollment path (filter Passkeys)
3. MFA-scored banks — national and Texas scorecard banks, plus MFA tables inside every state top banks email-security listicle (filter Region → [state] in this directory)
4. State bank listicles — banks from every top-{state}-banks-email-security-2026 post and the major U.S. banks list, each MFA-graded from public docs (Strong / Pass / Partial / Fail)
5. Credit unions — every state top-{state}-credit-unions-email-security-2026 listicle plus major U.S. credit unions, each with an embedded MFA table and a Category → Credit Unions row here
6. Investment firms / brokerages — major U.S. investment firms (Schwab, Fidelity, Vanguard, Interactive Brokers, and peers) with an embedded MFA table and Category → Investment Firms
7. Higher education — campus MFA docs when researched (e.g. Houston City College Fail; UTSA Strong on YubiKey); filter Category → Higher Education
8. Travel — airline loyalty MFA when researched (e.g. Delta SkyMiles / Flight 591 Wi-Fi); filter Category → Travel
9. Healthcare — patient-portal MFA when researched (e.g. JPS MyChart / Fort Worth outage); filter Category → Healthcare
10. Social & Professional — consumer social MFA when researched (e.g. FBI NCII / lookalike support phishing: Instagram Pass, Facebook Strong; LinkedIn already listed); filter Category → Social & Professional

The table defaults to Banks and paginates 50 rows at a time. Switch Category → Investment Firms, Credit Unions, Higher Education, Travel, Healthcare, or Social & Professional, or use Supporters only, Passkeys, Region → [state], or Grade. Businesses that ship real YubiKey, open-TOTP, or passkey docs can request a listing.

Eligibility (Strong / Pass supporters)

Passkeys are tracked in a dedicated Passkeys column. They improve phishing resistance when enrolled, but passkeys alone do not earn Strong/Pass when SMS/voice/email OTP remains a documented path — that is usually Partial (or Fail if OTP is still the primary story).

Bank, credit union, and investment firm listicle rows stay in the directory even when graded Fail or Partial, so readers can compare Chase, Schwab, Navy Federal, and Vanguard next to true supporters like Bank of America.

Listings are editorial — not a logged-in mystery shop of every account tier, and not paid placement.

How listings are graded

A row can show Yes for YubiKey, TOTP, and Passkeys and still be graded Strong when a hardware-key path is documented. Domain audits (ideal 100%) are a separate control plane — strong MFA docs do not imply a perfect email/website score.

Passkeys in this directory

Passkeys are WebAuthn / FIDO credentials stored on a device, in a platform authenticator (Windows Hello, iCloud Keychain, Google Password Manager), or in a third-party password manager that offers a passkey vault (for example Proton Pass). They are not the same thing as a physical YubiKey, even though both can use FIDO protocols — a YubiKey is a portable security key; a passkey is often synced or device-bound without a separate USB/NFC dongle.

Examples already in the table:

• Google — Strong: passkeys, open TOTP, and YubiKey-class security keys
• Facebook — Strong: U2F/FIDO2 security keys, authentication app, Meta passkeys (SMS still offered)
• Instagram — Pass: Google Authenticator / open TOTP plus Meta passkeys; Instagram 2FA help does not document hardware keys
• X Money — Strong: passkeys required plus confirmed hardware FIDO key enrollment
• Chase / U.S. Bank / Wells Fargo / Capital One / Truist — Fail-grade bank rows that still document passkeys while phone OTP or app push remains in the MFA story
• PenFed / Digital FCU (DCU) — credit-union rows with documented passkeys (Pass / Partial); First Tech documents open TOTP (Pass)
• Vanguard / Interactive Brokers / Merrill / Morgan Stanley — investment-firm Strong rows (FIDO security keys); Fidelity documents open TOTP (Pass); Schwab stays Partial on Symantec VIP
• Bank of America — Strong on YubiKey/FIDO USB security key; Passkeys = No (hardware key ≠ platform passkey)
• Proton — Strong on YubiKey + TOTP for Proton Account; Passkeys = No for account login (Proton Pass stores passkeys for other sites)

Bank passkeys evaluation (August 2026)

We re-checked every Banks row in this directory (originally 293 domains before the Credit Unions category split; 272 Banks rows now) for documented consumer/self-serve passkey enrollment.

Result: 7 bank catalog rows (6 institutions) have Passkeys = Yes. The other 286 Banks rows stay No until we can link bank-specific public evidence.

Notable No among large catalog banks (public enrollment docs not found in this pass): Bank of America (USB security key only), Citibank, Ally, PNC, TD Bank, Citizens, Fifth Third, Huntington, Regions, M&T, KeyBank, Frost, Comerica, and most state-listicle community banks.

Some digital-banking platforms (for example Jack Henry Banno) can enable passkeys FI-by-FI. We still require that bank’s public docs or login UI before flipping Passkeys to Yes — platform capability alone is not enough.

Filter the directory with the Passkeys checkbox (Category → Banks) to see the Yes set. Tell us if a listed domain added passkeys after our last docs check — use correction.

Directory