What is a phishing-resistant MFA method on mobile and why is it superior to TOTP (Time-based One-Time Password) for account security?

• A.C) SMS OTP is the most phishing-resistant MFA method because the code is delivered out-of-band through the cellular network.
• B.B) TOTP is phishing-resistant because codes expire every 30 seconds; a phishing attacker cannot use an intercepted code.
• C.A) FIDO2/WebAuthn passkeys and hardware security keys are phishing-resistant because the cryptographic ceremony binds the credential to the exact origin (domain) of the legitimate site; even if a user is tricked into visiting a phishing site (different domain), the passkey never releases a credential for that domain. TOTP codes are phishing-able because the user types the 6-digit code into the phishing site, which then replays it to the real site in real time.