Multi-factor authentication (MFA) is one of the most effective security controls an organisation can implement. Accounts protected by MFA are significantly harder to compromise than those relying on a password alone, and enabling it across your organisation is absolutely worthwhile.
However, it is important to understand what MFA does and does not protect against. While it prevents a large proportion of account compromise attempts, several common attack techniques are now specifically designed to bypass it.
How MFA gets bypassed
One of the most common techniques is known as MFA fatigue, sometimes referred to as prompt bombing.
It typically works like this: an attacker obtains a username and password through phishing, credential stuffing, malware, or from credentials leaked in a third-party breach. They then repeatedly attempt to log in, generating MFA approval prompts on the legitimate user’s device each time.
Eventually, some users approve the request simply to stop the notifications. They may assume it is a system glitch or believe they triggered the login accidentally themselves. Attackers rely heavily on this behaviour. In many cases, attempts are deliberately timed for late at night or early in the morning when someone is tired, distracted, or less likely to question the request.
This is not a theoretical risk. Several well-known breaches in recent years, including the 2022 Uber compromise, involved MFA fatigue techniques combined with social engineering.
Another increasingly common approach involves adversary-in-the-middle phishing proxies. In this scenario, the attacker places a fake login page between the victim and the legitimate service, relaying traffic in real time.
When the victim enters their credentials and MFA code, the phishing proxy captures the information and immediately uses it to authenticate against the real service. Because MFA codes are generally valid for a short period, the attacker can successfully establish an authenticated session before the code expires. To the victim, the login process often appears completely normal.
In some cases, attackers do not even need the MFA code itself. Session cookies stolen through phishing frameworks such as Evilginx can allow attackers to hijack authenticated sessions directly.
What this means in practice
None of this means MFA is ineffective. Far from it. MFA remains one of the most valuable security controls available and successfully blocks the majority of automated account compromise attempts.
The important point is that MFA is not a complete security solution on its own. Like any control, it has limitations, and organisations should understand where additional protections are needed.
Choosing the right MFA method matters
Not all MFA methods provide the same level of protection.
Hardware security keys using FIDO2/WebAuthn standards are currently among the most resistant to phishing attacks because authentication is tied to the legitimate domain. Authenticator applications are generally more secure than SMS-based authentication or simple push notifications, although they are still vulnerable to sophisticated phishing proxy attacks in some scenarios.
If your organisation faces a higher risk of targeted attacks, reviewing the MFA methods currently in use is worthwhile.
Staff awareness remains critical
Users should be explicitly trained to reject and report unexpected MFA prompts.
This sounds straightforward, but many people have never been told what an unsolicited MFA request actually means. Attackers rely on confusion, urgency, and routine behaviour. A single mistaken approval can be enough to give an attacker access to an account.
Security awareness training should include examples of MFA fatigue attacks and explain how staff should respond.
Authentication monitoring provides visibility
Reviewing authentication logs can help identify suspicious behaviour before it escalates into a larger incident.
Repeated failed logins followed by a successful authentication attempt, impossible travel events, unfamiliar devices, or sign-ins occurring outside normal working hours are all indicators worth investigating.
Without centralised logging and monitoring, these warning signs are often missed entirely.
Conditional access policies add valuable friction
Modern identity platforms such as Microsoft Entra ID and Okta support conditional access policies that can apply additional controls based on risk.
For example, organisations can require additional verification when a login originates from:
- an unfamiliar device
- a new geographic location
- a high-risk IP address
- outside normal working hours
Conditional access will not stop every attack, but it significantly increases the difficulty for attackers and reduces reliance on MFA alone.
Getting the foundations right
Effective security is rarely about deploying a single perfect control. It is about layering defences so that bypassing one mechanism does not immediately result in a full compromise.
MFA remains an extremely effective security layer and should be enabled wherever possible. It is most effective when combined with strong authentication policies, staff awareness training, endpoint protection, logging and monitoring, and sensible access controls.
Organisations that treat MFA as part of a broader security strategy are far better positioned to detect and resist modern account compromise attacks.
If you want help reviewing your current authentication setup or understanding where your gaps might be, get in touch.