MFA Bypass Risks

MFA dramatically reduces account takeover, but it is not a silver bullet.

Attackers have developed several techniques to bypass weaker forms of MFA.

SIM swapping tricks a mobile carrier into moving a victim's phone number to the attacker's SIM.

Any SMS-based codes then arrive at the attacker. This is why SMS is the weakest second factor.

Tools like adversary-in-the-middle proxies sit between the user and the real site.

They relay the login and the OTP in real time, and steal the resulting session cookie. This defeats SMS, TOTP, and even push.

If an attacker steals an authenticated session token or cookie after MFA, they skip MFA entirely.

Malware, stolen browser data, or XSS can leak these tokens.

With push-based MFA, attackers who already have the password spam approval prompts.

An exhausted or confused user eventually taps Approve, granting access. Number matching defends against this.

Account recovery flows are a frequent weak point. If resetting a password or MFA only needs an email link or a security question, attackers target that instead.

Recovery must be as strong as primary login.

The strongest defense is phishing-resistant MFA: FIDO2 security keys and passkeys.

Because credentials are bound to the real origin, a proxy phishing site cannot relay a valid authentication.

Real-time phishing fails against FIDO2 because the security key signs a challenge tied to the fraudulent domain, which the real server rejects.

There is no code for the user to retype and no reusable secret to steal.

Pair MFA with other controls:

• Risk-based step-up authentication
• Short session lifetimes and re-auth for sensitive actions
• Device binding and token binding
• Monitoring for impossible travel

To close the recovery gap:

• Avoid security questions.
• Require a registered second key for MFA reset.
• Add delays and notifications on recovery attempts.

Even strong MFA benefits from aware users:

• Never approve a push you did not initiate.
• Be suspicious of urgent login prompts.
• Report unexpected MFA requests immediately.

Which MFA method best resists a real-time phishing proxy that relays codes and steals session cookies?

You learned how MFA gets bypassed and how to harden it.

• SIM swap, real-time phishing, session theft, and MFA fatigue are key threats.
• Phishing-resistant MFA (FIDO2 / passkeys) is the strongest defense.
• Harden recovery flows and use defense in depth.

Next module: Identity and Access Management.