Introduction
MFA is the highest-value control most organisations can deploy, and it is routinely deployed in the weakest available form. Understanding why some factors resist attack and others do not is what turns a compliance checkbox into a real defence.
How it works
A factor is something you know, have, or are. The strength of a factor is not about the category but about whether it can be relayed. A code you can read and type can be read and typed by someone you are talking to on the phone. A cryptographic response bound to the site you are actually visiting cannot.
That single property — origin binding — separates phishing-resistant factors from the rest.
Common risks
SMS can be intercepted through carrier attacks. Time-based codes can be relayed in real time by a convincing proxy. Push approvals can be worn down by repetition until someone taps accept. None of these make MFA worthless; they make it beatable by a motivated attacker.
How to detect it
Watch for repeated failed MFA prompts against one account, approvals from unexpected locations, and enrolment of new factors shortly after a password reset. Enrolment events deserve the same scrutiny as logins.
How to defend
Prefer origin-bound factors such as security keys or passkeys for administrators. Enable number matching on push. Rate limit prompts. Treat factor enrolment as a sensitive action requiring re-authentication. Keep a documented recovery route that does not itself become the weak link.