Why Traditional MFA Methods Fail Against Targeted Attacks

While multi-factor authentication (MFA) is a standard component of most security frameworks, the specific method used to implement it can create a significant gap in organisational defence. Compliance reports often treat all forms of MFA as equal, yet the difference between a push notification and a hardware security key determines whether an account can resist a targeted attack.

Recent major security incidents, including the 2022 Uber breach and the MGM Resorts intrusion, have demonstrated that having MFA enabled is not a guarantee of protection. In many cases, attackers successfully bypassed MFA by exploiting the inherent weaknesses of common authentication methods.

The Vulnerabilities of Push and OTP

Push notification MFA is widely used because it is easy to deploy. However, this convenience has made it a primary target for attackers using a technique known as MFA bombing or push fatigue. In these scenarios, an attacker who has already stolen a user’s password sends repeated approval requests to the user’s mobile device. The goal is to annoy or confuse the user until they eventually tap “approve” to stop the notifications.

One-time passwords (OTP) sent via SMS present a different set of risks. Attackers can intercept these codes through SIM swapping, where they convince a mobile carrier to move a victim’s number to a device they control. Furthermore, modern phishing kits built around reverse-proxy tools can intercept OTPs in real time. In these attacks, the victim enters their code into a fraudulent login page, which then forwards the credentials to the legitimate site, allowing the attacker to hijack the session.

These methods are often used in conjunction with the same psychological manipulation found in credential theft techniques to bypass traditional defences.

The Role of Phishing-Resistant MFA

To close these gaps, newer standards such as FIDO2 and passkeys rely on cryptographic origin-binding. Unlike a code or a simple notification, a passkey is tied to a specific website through a mathematical process. When a user attempts to log in, the browser checks the website’s identity. If the site is a lookalike or a phishing domain, the authentication fails immediately because the cryptographic key will not match the fraudulent origin.

This prevents the user from being accidentally fooled, as the technology itself recognises that the destination is not legitimate. However, security professionals note that a system is only as strong as its weakest link. For example, a hardware key that allows a fallback to a vulnerable SMS-based OTP does not provide full phishing resistance.

Strategic Migration Paths

Transitioning to phishing-resistant MFA is often difficult due to the friction it may introduce and the costs of hardware. Legacy on-premises systems and certain SaaS platforms may not natively support WebAuthn, requiring organisations to implement compensating controls or face complex replacement cycles.

Rather than attempting to convert an entire workforce at once, effective security strategies focus on high-risk users first. This typically includes:

• Administrator accounts: Those with the ability to manage identity providers or reset user credentials.
• Privileged access users: Individuals with access to sensitive infrastructure.
• Critical departments: Finance and engineering teams that interact with high-value systems.

For legacy applications that cannot yet support modern standards, organisations can implement conditional access policies to limit exposure. Security teams are encouraged to perform audits that distinguish not just which accounts have MFA enabled, but exactly which authentication method is protecting them.