Multi-factor authentication (MFA) is among the most useful safeguards against password abuse. CISA emphasises that any MFA is better than none, while warning that methods differ in resilience. Attackers have learned to bypass weaker ones.
How attackers bypass MFA
Public guidance, including CISA's Implementing Phishing-Resistant MFA, describes common scenarios:
- Phishing pages capture passwords and one-time codes for immediate reuse.
- MFA fatigue, or push bombing, repeatedly prompts users until they approve by mistake or exhaustion.
- Phone number takeover or mobile network weaknesses expose SMS codes.
- Session theft: adversary-in-the-middle phishing captures a session token after login, removing the need for the password or code.
These attacks rely on people entering or approving something in the wrong place or at the wrong time. Methods depending less on momentary attention are more resilient.
Phishing-resistant methods
Phishing-resistant authentication cryptographically binds verification to the intended service. Examples include FIDO2/WebAuthn security keys and passkeys, and certificate or smart-card authentication. Browsers or devices verify the service, preventing authentication on an impostor site even if users fail to recognise it.
NIST SP 800-63B states that one-time codes and out-of-band authentication, including mobile approval, are not phishing-resistant. They remain useful, but are insufficient for the most sensitive accounts.
Prioritise deployment by risk:
- Administrators, cloud administrators and backup accounts.
- Management, finance and payment approvers.
- Remote access and email for all employees.
- Other applications according to data sensitivity.
Plan spare keys, loss recovery and legacy systems without FIDO2 support. Track stronger method adoption and record exceptions with reasons and review dates, so temporary exceptions do not become permanent.
While you still use mobile push approval
FIDO2 migration is often gradual. Meanwhile, strengthen push approval:
- Number matching: users enter the number shown at login, preventing accidental approval. Microsoft Authenticator requires number matching for push notifications.
- Context: display the application and approximate sign-in location.
- Security alerts for repeatedly rejected prompts.
- Conditional access: require managed devices, block risky locations or require stronger authentication for sensitive applications. Microsoft provides Conditional Access; other providers offer similar controls.
- Limit SMS fallback where stronger alternatives exist.
Disable legacy protocols without MFA support. Review account recovery too: if a helpdesk call or email reset bypasses MFA, attackers may use that route. Reset identity checks should be as robust as login checks.
Monitor unusual locations and registration of new MFA methods. Attackers with access may add their own device.
Training that helps
Technology reduces risk, but people remain part of defence. Useful training teaches recognition and confident reporting without shaming mistakes.
Employees should know:
- Reject and report unexpected login approval requests.
- How and to whom suspicious messages or logins should be reported.
- The helpdesk will never ask for passwords or codes.
- Reporting a mistake helps protect the organisation.
Simulated phishing can support learning. Measure reporting and response time rather than clicks alone. CISA and partners provide further advice in Phishing Guidance: Stopping the Attack Cycle at Phase One.
Checklist
- MFA covers users and internet-accessible services.
- Administrative and sensitive accounts use phishing-resistant methods.
- Mobile approval uses number matching and context.
- Repeated rejections trigger alerts.
- Conditional access protects sensitive applications.
- Account recovery and MFA resets verify identity robustly.
- Legacy protocols without MFA are disabled or restricted.
- Employees know how to report suspicious sign-ins.
We can review your current setup and propose gradual improvements. Arrange a consultation.
