Multi-Factor Authentication: What It Stops, and What Still Gets Through

Multi-factor authentication proves who you are with two or more types of evidence, not a password on its own. It is the single control security researchers point to most often when they explain why an attack failed. But it is not magic. Attackers now have working playbooks for getting past it. What a business does after switching MFA on matters almost as much as switching it on at all.

What does multi-factor authentication actually check?

A login protected by multi-factor authentication needs at least two of three things. Something the user knows, such as a password or PIN. Something the user has, such as a phone, an app or a hardware key. And something the user is, a fingerprint or a face scan. CISA, the US government’s cyber agency, describes MFA as a layered approach. A system will not confirm someone’s identity until it sees a combination of two or more credentials.

That layering is the whole point. A phished password is common. A phished password and a physical security key are much rarer, because the attacker would need to steal both at once.

How much difference does MFA make in practice?

A lot, but not infinitely. Microsoft’s research team analysed real Azure Active Directory accounts. MFA cut the chance of compromise by 99.22% overall, and by 98.56% even when the password had already leaked. Few security controls come close to that return for the effort involved.

Set against that: Cisco Talos handles live incident response cases. It saw authentication abuse in 65% of its engagements during the second quarter of 2026, nearly double the 35% recorded the quarter before. MFA stops most opportunistic attacks cold. A determined attacker with the right technique still finds a route through some implementations. Both things are true at once.

How do attackers actually get past MFA?

Four techniques show up again and again in real incidents, according to Talos.

• Adversary-in-the-middle (AiTM) phishing: the victim logs into what looks like the real site, but the page is really a proxy. It passes the login through and captures the session token the instant MFA succeeds. The attacker then uses that token directly, and never needs the password or the code again. The Kratos phishing kit worked exactly this way against Microsoft 365 accounts.
• Session token theft: separate from phishing, malware on an infected device can lift the same session cookie straight out of the browser.
• Push bombing (MFA fatigue): once an attacker has a valid password, they trigger approval requests over and over, hoping a distracted employee taps approve just to make the notifications stop.
• Legacy protocols and self-enrolled devices: an older sign-in method that skips MFA entirely, or a new device an attacker registers to the account once they are already in.

Notice that none of these attacks rely on guessing or brute-forcing the second factor. They route around it instead. That is why the specific type of MFA a business deploys changes the outcome so much.

Which type of MFA actually holds up?

The NCSC ranks MFA methods on real resistance to these attacks, not just on whether they technically qualify as a second factor.

1. FIDO2 keys and passkeys stop AiTM phishing outright, because the cryptographic check only works on the genuine site’s address.
2. Authenticator app push approvals resist guessing and theft well but remain vulnerable to push bombing, since a human still makes the final call.
3. App-generated one-time codes beat a bare password, but a proxy can relay the code through in real time.
4. Hardware one-time code generators share the same weakness as app codes, and cover only one account per device.
5. SMS, email and phone call codes are the weakest choice, kept only for systems that support nothing better.

A short rollout checklist

For a business bringing in or reviewing multi-factor authentication, four steps do most of the work.

• Start with the accounts that matter most. Email, remote access and anything with admin rights first, because those give an attacker the widest reach.
• Turn on number matching or app-based approval, not SMS, wherever the service allows it.
• Block legacy authentication protocols that let old clients sign in without MFA at all.
• Check shadow IT. Any tool staff sign into with a work email counts, even ones IT never provisioned.

This also lines up with a wider compliance shift. From 26 April 2026, Cyber Essentials treats a missing multi-factor authentication setting on any in-scope cloud service as an automatic fail, according to IASME’s official update. Existing assessment accounts get a six-month grace period, but new ones do not.

Common mistakes businesses make with MFA

Most gaps are not about the technology. They are about coverage and configuration. A business rolls out multi-factor authentication on the main email platform. It then leaves a finance tool, a file-sharing app or an old VPN client untouched, because nobody thought to check it. Attackers look for exactly that gap.

Another common mistake is choosing SMS by default because it is familiar, then never revisiting that choice once an authenticator app becomes available. A third is leaving legacy authentication protocols switched on for compatibility. That lets older software sign in without ever being asked for a second factor. Each of these turns a strong control into a weak one, without anybody deciding that on purpose.

A periodic check, ideally an independent one, catches these gaps before an attacker does. That is really what a penetration test does for authentication. It tries the same routes in that a real attacker would use, including the forgotten app and the reused password a spreadsheet audit tends to miss. Aardwolf Security builds this kind of check into its authentication and access testing. It costs nothing to ask what a scoped test of your MFA setup would look like.

Frequently asked questions

Does enabling MFA guarantee an account is safe?

No. It removes the most common route in, a stolen or guessed password, but a phishing-resistant method like FIDO2 protects far better than SMS or a basic push notification.

What is push bombing?

It is when an attacker who already has a valid password sends repeated MFA approval requests, hoping the user eventually taps approve out of fatigue or confusion.

Why is SMS-based MFA considered weak?

A code sent by text can be relayed by a phishing proxy in real time, and SIM-swap fraud can redirect the text to the attacker’s own phone.

Is two-factor authentication the same as multi-factor authentication?

Two-factor authentication uses exactly two factors and counts as one form of MFA. MFA is the broader term and can use more than two.

Does MFA satisfy Cyber Essentials on its own?

It satisfies the MFA requirement, but Cyber Essentials also covers firewalls, patching, access control and malware protection, so MFA is necessary rather than sufficient.

How can a business tell if its MFA setup would actually stop an attacker?

Reading the settings page is not enough, because the weakness usually sits in a forgotten app or an unblocked legacy protocol rather than the main login screen. Testing the real login paths, the way an attacker would, is the only way to find that out with any confidence.