Multi-Factor Authentication: Not All Second Factors Are Equal

Multi-factor authentication is the most effective single security control most people can turn on — Microsoft's telemetry has long shown it blocks the overwhelming majority of account-compromise attempts. But "MFA" describes a range of methods that differ by orders of magnitude in strength, and attackers have adapted to the weakest ones. The question in 2026 isn't whether to use MFA; it's which kind, and whether it survives phishing.

The factors

Authentication factors are things you know (password, PIN), things you have (phone, hardware key) and things you are (fingerprint, face). MFA combines at least two from different categories, so that stealing one — the password, which is stolen constantly — isn't enough. Two passwords aren't MFA. A password plus a code from your phone is.

Ranking the second factors

From weakest to strongest:

• SMS and voice codes. Better than nothing, but vulnerable to SIM-swapping (an attacker persuades your carrier to port your number), SS7 network interception, and — most commonly — simply being phished: the attacker's fake login page asks for the code and relays it in real time. NIST has discouraged SMS as a factor since 2017.
• Email codes. Same phishing problem, plus the email account is often the thing being attacked.
• Authenticator apps (TOTP). A time-based code generated on your device from a shared secret. Immune to SIM swaps, but still phishable — the code is just a number the user can be tricked into typing into the wrong site.
• Push notifications. Approve a prompt on your phone. Convenient, but enabled a whole attack class: MFA fatigue, where the attacker who has your password triggers prompts repeatedly until you approve one to make it stop. This is how Uber was breached in 2022. Number matching (typing a code shown on the login screen into the prompt) largely fixes it.
• Hardware security keys (FIDO2/WebAuthn). A physical device — YubiKey and similar — that signs a challenge bound to the website's real domain. A phishing site on a lookalike domain gets a signature that's useless to it. Nothing to read out, nothing to relay. This is what "phishing-resistant MFA" means.
• Passkeys. The same FIDO2 cryptography, with the private key stored in your phone or laptop's secure hardware (or synced through your platform's password manager) and unlocked by your biometric or device PIN. Phishing-resistant, no separate device to carry, and increasingly the default on major consumer services. They can also replace the password entirely rather than supplementing it.

How attackers beat weak MFA

The mainstream technique is the adversary-in-the-middle proxy. Kits like Evilginx and the phishing-as-a-service platforms that package them sit between the victim and the real site, relaying the login page live. The victim enters their password and their TOTP or SMS code into what looks like the genuine site; the proxy forwards them, completes the login, and captures the resulting session cookie. From then on the attacker is the user, MFA already satisfied. These kits are sold for a few hundred dollars a month and are behind a large share of business email compromise. Only origin-bound credentials — hardware keys and passkeys — defeat them, because the signature is tied to the domain the browser actually connected to.

Deploying MFA in an organisation

• Everyone, every account, no exceptions. The account without MFA is the one that gets used. Service accounts and legacy protocols that can't do MFA should be inventoried and retired or isolated.
• Phishing-resistant for privileged and high-value users first — administrators, finance, executives, anyone who can move money or change access. US federal agencies have been required to do this since 2022; it's now the standard expectation in insurance questionnaires.
• Disable SMS where you can; where you can't, at least don't allow it for admin roles.
• Enable number matching on push and set a lockout after repeated denials.
• Secure the recovery path. The fallback — "lost your device? answer these questions" — is frequently weaker than the MFA it bypasses. Recovery should require identity verification proportional to the account's value.
• Protect sessions, not just logins. Short session lifetimes, re-authentication for sensitive actions, and detection of session tokens used from a new device or location — because token theft is how MFA gets bypassed after the fact.
• Make it easy. Passkeys are faster than passwords. Framed as an upgrade rather than a burden, adoption goes up.

Where this is going

The trajectory is toward passwordless: passkeys as the primary credential, biometrics as the local unlock, device health as an additional signal, and continuous risk evaluation during the session rather than a single check at login — the identity layer of zero trust. Passwords won't disappear for years, but the accounts that matter most can already leave them behind.