MFA Stopped Being Enough About Two Years Ago
Attackers routinely bypass text and app-based MFA with session theft and push fatigue. What phishing-resistant authentication looks like for a small business.
The short answer
Standard multi-factor authentication is bypassed three ways in active use: adversary-in-the-middle proxies that steal the session token after a correct MFA prompt, push fatigue, and SIM swap. The defense is origin binding, which only FIDO2 security keys and passkeys provide, because the credential is cryptographically tied to the real domain.
Turning on multi-factor authentication was the single best security decision most small businesses made in the last decade. It is still worth having. It is no longer sufficient, and the gap between what owners believe MFA protects against and what it actually stops has gotten wide.
The three bypasses in active use
Adversary in the middle. The victim clicks a link and lands on a proxy that looks exactly like the real login page, because it is relaying the real login page. They enter the password, they complete the MFA challenge, and the proxy captures the resulting session token. The attacker then uses that token, and never has to authenticate again. Every MFA prompt was satisfied correctly. The account is still compromised. Off-the-shelf kits for this have been circulating for years.
Push fatigue. The attacker has the password and simply triggers approval prompts repeatedly, often at two in the morning, sometimes combined with a call claiming to be IT. Eventually someone taps approve to make it stop.
SIM swap. Text-message codes are delivered to whoever controls the phone number, and phone numbers are transferable with a convincing enough call to a carrier. This is the reason SMS is the weakest common factor.
What phishing-resistant actually means
The property that defeats the first attack is origin binding. The credential is cryptographically tied to the real domain, so it will not produce a valid response for a lookalike site. The proxy has nothing to relay.
Two technologies have this property today. FIDO2 security keys, the physical devices you plug in or tap. And passkeys, the same underlying standard implemented in a phone, laptop, or password manager.
Neither is exotic anymore. Both are supported natively by Microsoft 365 and Google Workspace, and a hardware key costs about the same as a nice dinner.
The rollout order that works
Start with the accounts that would end your business.
Global administrators and tenant admins first. Every one of them, hardware keys, no exceptions, and at least two keys per admin so a lost key is an inconvenience rather than a lockout. If you have more than two or three global admins in a small business, that is its own finding.
Then finance and anyone who can move money. Then executives, who are targeted specifically because their mail carries authority. Then everyone else, on passkeys rather than hardware keys, since passkeys cost nothing and the enrollment experience is good.
Turn off the weak factors as you go. Leaving SMS enabled as a fallback preserves the exact hole you spent the money to close, because the attacker will simply request the fallback.
The controls that matter alongside it
Conditional access policies that require compliant or managed devices for administrative actions. Even a stolen session token is less useful from an unmanaged machine in another country.
Shorter session lifetimes for privileged accounts. Session theft is only valuable while the session lives.
Sign-in risk policies that force re-authentication on impossible travel and unfamiliar device patterns. This is included in the license tiers most businesses already own and frequently sits unconfigured.
Legacy authentication disabled entirely. Old protocols that predate MFA still exist in many tenants and they will happily accept a password with no second factor. Check this today. It takes five minutes and it is the most common finding in our assessments.
Number matching on push approvals if you are keeping push as a factor for part of the population. It converts a reflexive tap into a deliberate action and kills the fatigue attack.
The objection you will hear
Somebody will say hardware keys are inconvenient. In practice, the admins we have moved to keys report the opposite within a month, because tapping a key is faster than opening an app and typing six digits.
The real friction is enrollment and lost-key recovery, both of which are process problems. Plan the recovery path before you deploy, document it, and make sure it does not become a social engineering target of its own. An account recovery process that a helpful support person can be talked through undoes everything above it.
Get the checklist
The MFA Maturity Checklist scores your current state across factor strength, admin coverage, legacy protocol status, conditional access, session controls, and recovery process. It produces a maturity level from one to five and a prioritized fix list with effort estimates.
Most small businesses land at level two and can reach level four in a weekend of configuration.
Frequently asked questions
Can multi-factor authentication be bypassed?
Yes, three ways currently in active use. An adversary-in-the-middle proxy relays the real login page, captures the session token after a correct MFA prompt, and reuses it without authenticating again. Push fatigue triggers repeated approvals until someone taps to make it stop. SIM swap redirects text codes to a transferred phone number.
What is phishing-resistant MFA?
Authentication where the credential is cryptographically bound to the real domain, so it will not produce a valid response for a lookalike site and a proxy has nothing to relay. Two technologies have this property today: FIDO2 hardware security keys and passkeys implemented in a phone, laptop, or password manager.
Should we turn off SMS-based MFA?
Yes, as you deploy stronger factors. Leaving SMS enabled as a fallback preserves the exact hole you spent money to close, because an attacker will simply request the fallback. Remove it entirely for privileged accounts rather than merely discouraging it.
What should a small business do first to improve MFA?
Check whether legacy authentication protocols are still enabled. Old protocols predate MFA and will accept a password with no second factor. This is the most common finding in our assessments, it takes about five minutes to check, and blocking it is the single highest-value change available.
Related reading
- Your AI Tools Have Logins Now, and Nobody Is Managing Them
- The Voice on the Phone Is Not Your CFO
- The Microsoft 365 Settings Most Phoenix Businesses Never Turned On
- Anyone Can Send Email as Your Company Until You Fix This
- Your Weakest Security Control Belongs to Somebody Else
- Offboarding an Employee in 60 Minutes