Skip to content

Why MFA Fails, and What To Do About It

Multi-factor authentication stops most credential attacks and none of the ones aimed at it. Know which is which.

Intermediate 8 min read Identity & Access

What you will learn

  • The real difference between MFA factor types
  • How push fatigue and relay attacks work conceptually
  • Why SMS remains the weakest common factor
  • How to choose factors for your actual threat model

Introduction

MFA is the highest-value control most organisations can deploy, and it is routinely deployed in the weakest available form. Understanding why some factors resist attack and others do not is what turns a compliance checkbox into a real defence.

How it works

A factor is something you know, have, or are. The strength of a factor is not about the category but about whether it can be relayed. A code you can read and type can be read and typed by someone you are talking to on the phone. A cryptographic response bound to the site you are actually visiting cannot.

That single property — origin binding — separates phishing-resistant factors from the rest.

Common risks

SMS can be intercepted through carrier attacks. Time-based codes can be relayed in real time by a convincing proxy. Push approvals can be worn down by repetition until someone taps accept. None of these make MFA worthless; they make it beatable by a motivated attacker.

How to detect it

Watch for repeated failed MFA prompts against one account, approvals from unexpected locations, and enrolment of new factors shortly after a password reset. Enrolment events deserve the same scrutiny as logins.

How to defend

Prefer origin-bound factors such as security keys or passkeys for administrators. Enable number matching on push. Rate limit prompts. Treat factor enrolment as a sensitive action requiring re-authentication. Keep a documented recovery route that does not itself become the weak link.

Security checklist

  • Security keys or passkeys for admins
  • Number matching on push approvals
  • Rate limit MFA prompts
  • Protect and monitor factor enrolment
  • Document a safe recovery route
Authorised lab

Covered practically in the Advanced track. Never apply these techniques to a system you do not own or have written permission to test.