In an era where passwords are constantly exposed — through data breaches, phishing or malware — a strong password alone no longer provides adequate protection. This is where multi-factor authentication (MFA) comes in, which has become one of the most effective ways to protect accounts and systems. But there’s a critical nuance most businesses miss: not all types of MFA are equal, and some are already routinely bypassed by attackers.
What MFA is and how much it really helps
MFA adds an extra layer of security by requiring the user to prove their identity in more than one way — usually "something you know" (a password) together with "something you have" (a phone, app or hardware key). Even if an attacker obtains the password, they still have to pass the second step.
The impact is enormous: according to data published by Microsoft, enabling MFA blocks over 99% of common account-takeover attacks. It’s one of the cheapest and most effective protections a business can implement. But — and it’s an important but — that figure mainly holds against mass attacks, not against a targeted, sophisticated attacker.
Not all MFA is created equal
The difference between MFA types is critical. A code that arrives by SMS is exposed to SIM-swapping attacks and real-time phishing. Authenticator apps (like Microsoft Authenticator or Google Authenticator) are much better, but they too aren’t fully "phishing-resistant" — an attacker with a real-time phishing server can still capture the code. Hardware keys and Passkeys based on the FIDO2 standard are the highest level of protection: they cryptographically bind the login to the real site, so a fake phishing site simply cannot steal the credential.
| MFA method | Security level | Main weakness |
|---|---|---|
| SMS code | Low | SIM swap, real-time phishing |
| Authenticator app (TOTP) | Medium-good | Real-time phishing (proxy) |
| Push + Number Matching | Good | Still not fully phishing-resistant |
| FIDO2 / Passkey / Hardware key | Highest | Physical loss of key (can be backed up) |
An important trend worth noting: leading security bodies, including the US CISA, now explicitly recommend moving away from SMS-based MFA for sensitive systems and high-privilege users, and adopting phishing-resistant methods.
The "MFA Fatigue" attack and how to defend against it
One of the common attacks against "Push" approvals is "MFA Fatigue": the attacker, who already holds the password, bombards the user with repeated approval requests hoping they’ll tap "Approve" out of habit or frustration. The simple, effective defense is "Number Matching" — instead of tapping "Approve", the user must type a number shown on the login screen into the app. This neutralizes most fatigue attacks, and it’s recommended to enable it in any organization using Push approvals.
Not just enabling — configuring correctly
It’s important not only to enable MFA, but to configure it correctly. Questions to ask: Are all users required to use it, or only some? Are there "escape routes" that bypass it (for example a password reset via SMS) that an attacker can exploit? Is there monitoring of suspicious login attempts? A critical point many organizations miss: even if you’ve deployed excellent Passkeys, if you’ve left a weak backup path like an SMS recovery code — the attacker will simply walk around the strong method and attack the weak one.
The guiding principle: phishing resistance is a property of the entire authentication chain, not just of the strongest method in it. A security chain is only as strong as its weakest link.
Frequently asked questions
Want to make sure your organization’s MFA truly protects you? We review your existing authentication setup, identify weak escape routes, and help deploy phishing-resistant methods in a way that doesn’t disrupt work. Talk to us for an introductory call.