Not All MFA Is Equal: What Actually Stops Attackers

You did the responsible thing. Multi-factor authentication is switched on, staff have the app, and a stolen password on its own is no longer enough to get into your email. That single change blocks more attacks than anything else on a typical small business checklist.

Here is the part that does not get said often enough: attackers adapted. The MFA most businesses turned on first can still be defeated, and the methods that defeat it are now packaged tools rather than expert work. The good news is the fix is a ladder, not a cliff. You can climb it a rung at a time, starting with the accounts that matter most.

Key takeaways:

• If a code can be typed, it can be handed to the wrong person. That is the dividing line between MFA that slows an attacker and MFA that stops one.
• Text-message codes are the weakest common option, because phone numbers can be moved to someone else’s SIM.
• If you use app approvals, make sure they require typing a number shown on screen rather than tapping “approve”. Tap-to-approve is what makes 2 a.m. prompt-bombing work.
• Start at the top. Administrators, finance, and the owner’s mailbox are worth more to an attacker than everyone else combined.

What “phishing resistant” actually means

The phrase gets used loosely in product marketing, but it has a precise meaning, and NIST spells it out in the current edition of its digital identity guidelines. Phishing resistance, it says, is “the ability of the authentication protocol to prevent the disclosure of authentication secrets and valid authenticator outputs to an impostor verifier”.

Translated: can a convincing fake login page get what it needs out of you? And NIST draws the line in a sentence worth taping to a wall. Authenticators “that involve the manual entry of an authenticator output” SHALL NOT be considered phishing-resistant.

Anything you read off a screen and type in can be typed into the wrong screen. It does not matter whether the code arrived by text, from an app, or off a hardware fob: if a human transfers it by hand, a fake site can ask for it and use it. Modern phishing kits do this in real time, sitting between you and the real service, passing your password and your code straight through while the clock is still running.

The ladder, from weakest to strongest

Text message and voice codes. Better than no second factor, worse than everything else. Beyond the typing problem, the code travels to a phone number, and phone numbers can be taken: someone convinces your mobile carrier to move your number to their SIM, and your second factor arrives on their handset. NIST classes use of the phone network here as restricted, and tells systems to watch for SIM changes and number porting as risk signals. Treat SMS as a stepping stone, not a destination.

App-generated codes. The six digits that rotate every thirty seconds. A genuine improvement, because there is no phone number to steal and no carrier to fool. Still typed by hand, though, so a real-time fake login page defeats it just as neatly. This is where a lot of businesses currently sit and assume they are finished.

Push approvals. The notification that asks “was this you?”. Better usability, and it removes the typing problem, but it introduced a new one: if all it takes is a tap, an attacker with your password can simply keep asking. Prompts at 11 p.m., then midnight, then 2 a.m., until someone half-asleep taps approve to make it stop. The fix is number matching, where the sign-in screen shows a number you must type into the app. Microsoft has made this standard for Authenticator push notifications and states plainly that users cannot opt out. If your approvals are still a bare approve-or-deny button, that is worth checking this week.

Security keys and passkeys. This rung changes the contest rather than raising the bar. A hardware security key, or a passkey stored on your phone or laptop, proves who you are with a cryptographic exchange rather than a code. Two things follow: there is no output for a human to hand over, and the credential is bound to the real website address, so a lookalike domain cannot use it even if the person is completely fooled. The attack does not get slower. It stops working.

The attack that gets past good MFA anyway

One honest caveat. MFA proves who signed in. It does not protect what happens next.

After a successful sign-in, the service hands your browser a session token, the thing that keeps you signed in so you are not challenged on every click. Steal that token, usually via malware on the machine, and an attacker resumes the session without ever facing your MFA. It is less common than password phishing, and it is why the rest still matters: protection on the endpoint that catches the malware, plus sensible session lifetimes so a stolen token expires.

Strong MFA is the highest-value control you can add. It is not the only one.

A staged plan that does not need a project

You do not have to buy hardware keys for everyone next week. Do it in this order.

Fix the weakest links at the top. Administrator accounts, finance, and the owner. Get those onto a phishing-resistant factor first. It is a handful of people and it removes the accounts an attacker most wants.

Turn on number matching everywhere. If you are on Microsoft 365, this is largely handled for you now. If you use another platform, check whether approvals are still tap-to-approve.

Retire SMS where you can, including as a backup. This is the one people miss. A strong primary factor with a text-message fallback is only as strong as the fallback, because an attacker will simply choose the weaker route. Where SMS cannot be removed, know it is there.

Sort out recovery before you need it. Backup codes stored somewhere real, and a documented way to get a locked-out employee back in that is not “the office manager approves it over the phone”. Attackers target the recovery path precisely because it is usually the softest part.

The accounts people forget

MFA on email is where everyone starts and too many stop. Walk the list of what else would hurt: remote access into your network, the accounting system, the payroll platform, the bank, the domain registrar, and the website host. The registrar deserves special attention, because whoever controls it can redirect your email and your website.

Then the awkward one: the password manager itself. It holds everything, so it needs your strongest factor, not your most convenient.

While you are in there, it is worth checking whether the passwords behind all this have already leaked, which our breached password checker will tell you without sending the password anywhere, and generating better ones with the passphrase generator. MFA is the second lock. It works best when the first one is not already open. If any of the terms above are new, the glossary explains them in plain English.

Worth knowing too: MFA coverage is the single most-asked question on cyber insurance applications, and “we have it on email” is not the same answer as the one being asked for.

Where this leaves you

If you take one thing away: find out whether your approvals require typing a number, and get administrator accounts onto a security key or passkey this quarter. Those two moves close the gap most small business MFA still has open.

The rest is sequencing, and doing it across dozens of accounts and a team who all have to keep working is where it stalls. That rollout is a normal piece of what we do for managed clients. If you want to know which rung you are actually on, we will tell you as part of a free assessment, or email hello@cohesivesecurity.com.