Yes, MFA can be bypassed or defeated—but enabling it is still one of the highest-value account protections. The key question is which factor is used and whether enrollment, recovery, sessions, devices, and support processes are equally protected. Passkeys and hardware security keys resist phishing better than manually entered one-time codes.
1. Real-time phishing proxy
A fake site can collect a password and relay it to the real service. When the victim enters an SMS or authenticator-app code, the proxy relays that too and captures the resulting session.
Manual one-time codes prove possession at a moment in time but are not bound to the legitimate website. NIST therefore does not classify manually entered OTP methods as phishing-resistant.[1]
Defense: Prefer FIDO/WebAuthn passkeys or security keys that cryptographically bind authentication to the service domain.
2. Push fatigue
An attacker with a password triggers repeated approval notifications and hopes the user accepts one to stop the noise. Attackers may call while pretending to be support.
Defense: Never approve an unexpected prompt. Use number matching, context-rich prompts, rate limits, and alerts—but move high-value accounts to phishing-resistant authenticators.
3. SIM swap and phone-number takeover
An attacker persuades or compromises a mobile provider into moving a number to another SIM. SMS codes and phone-based recovery then arrive to the attacker.
Defense: Use a carrier account PIN and port-out protections, avoid SMS for high-value accounts when stronger options exist, and harden account recovery.
4. Session-cookie theft
After successful MFA, a service issues a session cookie or token so the user does not authenticate on every request. Malware or a phishing proxy that steals a valid session may not need to perform MFA again.
Defense: Protect endpoints and browsers, shorten high-risk sessions, reauthenticate for sensitive changes, bind sessions to stronger signals where practical, and make session revocation easy.
5. Recovery and help-desk bypass
If support can remove MFA using easily researched personal information, the attacker targets support rather than cryptography. Recovery codes stored in email or screenshots can also become a weaker alternate factor.
Defense: Apply strong identity verification, delays and notifications for risky changes, restricted administrator actions, and well-protected recovery codes.
6. Malicious enrollment
An attacker who briefly controls an account may register a new authenticator, application password, OAuth grant, or recovery address. Changing the password later may leave this access intact.
Defense: Require recent strong authentication for factor changes, notify users out of band, inventory enrolled methods, and revoke sessions after suspected compromise.
7. Compromised endpoint
Malware on the user’s device may capture data after authentication, control the browser, approve actions in an existing session, or steal secrets from an unlocked authenticator.
Defense: Keep devices updated, restrict software and extensions, use endpoint protection, separate privileged administration, and require managed healthy devices for sensitive access.
MFA methods ranked by common phishing resistance
From generally stronger to weaker against ordinary remote phishing:
- Hardware security keys and properly implemented passkeys using FIDO/WebAuthn.
- Certificate or smart-card methods designed with phishing-resistant channel binding.
- Authenticator-app codes and push methods with number matching.
- SMS or voice codes.
- Email codes when the same email account is also the recovery root.
This is not an absolute ranking for every threat. A lost unlocked device, unsafe enrollment, or weak recovery can change the result.
What to do after approving a malicious prompt
From a trusted device, change the password, revoke all sessions, inspect MFA methods and recovery details, remove unfamiliar connected applications, check email rules, and contact the organization’s security team when work access is involved. Treat the event as possible account compromise, not merely a mistaken click.
The bottom line
MFA is not invulnerable, but “it can be bypassed” is not an argument against using it. Choose the strongest practical method, protect enrollment and recovery, monitor changes, and secure the sessions and devices that exist after authentication succeeds.
