MFA requires more than one independent factor before access is granted. A stolen password alone is therefore insufficient. Any suitable MFA is commonly better than password-only access, but manually entered codes and push prompts can still be phished. Passkeys and physical security keys offer stronger phishing resistance when properly deployed.
Last reviewed: 26 August 2026 · 10 min read
What counts as a factor?
Authentication factors are commonly grouped as:
- Something you know: password or PIN.
- Something you have: phone, authenticator app, security key or authorised device.
- Something you are: biometric used to unlock a local authenticator.
Two passwords are not two factors because both are knowledge. A password plus SMS code uses knowledge and possession, although the possession factor has limitations.
How MFA stops a common attack
Without MFA:
Stolen password → Account access
With MFA:
Stolen password → Second factor still required
This blocks many credential-stuffing and password-reuse attacks. It also creates an alert when a login prompt arrives that the user did not initiate.
MFA methods are not equivalent
SMS code
Widely available and better than password-only access in many situations. Risks include real-time phishing, SIM-swap attacks, message interception and loss of the number.
Email code
Convenient, but its security depends on the email account. If the same mailbox controls password reset and MFA, compromise can defeat both.
Authenticator-app code
Generated locally and independent of mobile delivery. The code can still be entered into a phishing site and relayed.
Push approval
Convenient, especially when it shows device, location and number matching. Repeated prompts can cause fatigue, and a user can approve an attack by mistake.
Security key or passkey
Uses cryptographic authentication bound to the genuine service. This prevents the user from giving a reusable code to a lookalike domain and is considered phishing-resistant when implemented correctly.
Choose the strongest practical option
If the service offers several choices, a general preference is:
- Passkey or FIDO security key.
- Authenticator with phishing-resistant or number-matching features where available.
- Authenticator code.
- SMS or email code when stronger options are unavailable.
The exact order depends on the service, device, risk and recovery model. Enabling SMS MFA is usually better than postponing all MFA while waiting for a perfect method.
Protect the recovery path
Attackers may bypass strong daily sign-in by targeting account recovery. Review:
- recovery email;
- mobile number;
- backup codes;
- security questions;
- trusted devices;
- customer-support identity checks; and
- linked accounts that can sign in.
A dormant recovery mailbox with a reused password can undermine a well-protected primary account.
Store backup codes deliberately
Backup codes are often single-use secrets that bypass the normal second-factor device. Keep them:
- offline in a secure physical location; or
- inside a separately protected vault with suitable access controls.
Do not save the only copy on the phone they are meant to replace. Never share a backup code with support or a caller.
Recognise MFA attacks
Prompt bombing
An attacker with the password triggers repeated approvals, hoping the user accepts one to stop the interruptions.
OTP relay
A fake site captures the password and current code, then uses both immediately on the real site.
Support impersonation
A caller says the code will cancel an attack when it actually approves access.
SIM swap
Stolen personal information is used to move a number to another SIM, allowing the attacker to receive SMS codes.
Recovery downgrade
The attacker persuades support to replace a strong factor with a weaker one.
The response is the same: do not approve an unrequested event, change the exposed password through the genuine site and review sessions and recovery settings.
Set up MFA without locking yourself out
- Start with primary email and the password manager.
- Add the strongest supported factor.
- Register a second authenticator where supported.
- Generate and store backup codes.
- Confirm the recovery email and number.
- Test sign-in on a normal second device.
- Remove obsolete phone numbers and devices.
- Record how to contact official recovery support.
Do not disable the last working factor until the replacement is tested.
Respond to an unexpected prompt
- Deny it.
- Do not share the displayed code.
- Open the service independently.
- Change the password if it may be known.
- Review recent sign-ins and authorised devices.
- Remove unknown sessions.
- check whether recovery information changed.
- Report the attempt through the platform’s security flow.
If financial or identity information is at risk, contact the relevant institution immediately.
Sources
- CISA: Turn On MFA
- CISA: More Than a Password
- CISA: Phishing-Resistant MFA Is Key
- NIST Digital Identity Guidelines: Authentication
- FIDO Alliance Passkeys
Follow on Google