After I tell people not to use easily phishable MFA, the first question they ask is what is and is not easily phishable? I have written dozens of articles explaining the types of MFA solutions which are easily phished and bypassed, including the precursor companion article for this article, explaining why you should not use easily phishable MFA, which is located here: https://www.linkedin.com/pulse/dont-use-easily-phishable-mfa-thats-most-roger-grimes

The most common question I get is which MFA solutions are not so easy to phish and bypass?

This article lists MFA solutions and types which appear to be phishing-resistant.