Is MFA always Sufficient?

Many companies believe that using only a password to log into an account is no longer enough.

This is where MFA (Multi-Factor Authentication) comes into play. The user first enters their password, and then either enters a code received on their phone or approves a login notification.

This second layer builds upon the password and reinforces the system.

However, there is an important detail here:

Not all MFA methods are equally secure.

How can MFA be bypassed?

Let’s take SMS or OTP (One-Time Password) as the simplest example.

An attacker can create various pages, including a fake login page, and send a link directing the user there. When the user enters their password followed by the verification code sent to their phone, the information is transmitted to the actual system.

In other words, even with MFA enabled, the user still hands over their authentication credentials to an attacker.

Think of it like a door that requires two keys to open.

Suppose a key pair is used, with the first key being the password and the second being the code sent to the phone. If both keys fall into the wrong hands, the two locks on the door won't be of much use.

What Is MFA Fatigue?

The second scenario is known as MFA fatigue or "push bombing."

In this scenario, an attacker repeatedly attempts a brute-force attack on your user account.

Notifications like the following begin to appear incessantly on the mobile device:

"Login request: Do you approve?"

One notification arrives, followed by another, and then another. A user might accidentally approve one of these requests or click "Approve" simply to stop the notifications.

This implies that systems relying solely on sending approval notifications to a phone are not entirely secure.

What is Phishing-Resistant MFA?

"Phishing-resistant MFA" is MFA where the authentication process is designed to withstand phishing attacks. The core logic here is not merely to require the user's presence for a second authentication step, but also, and more importantly, to verify that the system being accessed is indeed the legitimate one.

This is precisely where FIDO2 methods and "passkeys" offer significant advantages.

A passkey does not require the user to enter a password or an OTP code; instead, it utilises biometric authentication, a PIN (usually stored locally on the device), or a security key.

A key distinction is that the authentication process for this service can be cryptographically bound to a specific website or application.

For instance, when using a passkey, even if an attacker creates a fake site that perfectly mimics a genuine banking login page, the authentication data will not be transmitted to the incorrect domain.

This eliminates the need for the user to determine whether the site is legitimate each time they log in.

Are SMS Codes Still Effective?

Yes.

We are not saying they are completely useless, nor are we disparaging MFA methods based on SMS (OTP) or push notifications.

Even using a second authentication method alongside a password is far more secure than relying solely on a password. Nevertheless, organisations, especially when dealing with administrative accounts, financial tools, and users handling sensitive data, can consider stricter authentication techniques.

Of course, not all accounts carry the same level of risk.

While one employee might be accessing the company blog, another could be managing payment systems; however, the right security approach might not always be to apply the same method to both accounts.

MFA: It’s not just a checkbox

The mere statement "We use MFA at our company" means very little on its own.

The real questions to ask are:

Which MFA method is being used?

Can this method be bypassed if the user is deceived?

Are critical accounts protected by a stronger authentication method?

Multi-factor authentication (MFA) is a crucial part of a security strategy. However, security is about more than just adding a second layer.

Often, what makes the difference is how that second step actually works.

Disclaimer

This article is intended for informational purposes only and does not constitute legal, technical, commercial, or security advice.

‍