Multi-factor authentication (MFA) is a method that requires a user to present two or more independent factors from different categories (knowledge, possession, or inherence) to verify their identity. The premise is defense in depth: even if one factor is compromised, an attacker still can’t get in without the others.

Turn on MFA and you shut down the bulk of automated account-takeover attempts, which is why regulators and security teams push it so hard. The catch is that "MFA" now covers a wide range of methods with very different strength. Treating them as equivalent is a common and costly mistake.

How MFA works

After a user provides a first factor (often a password, though not necessarily), the system requires a second from a different category: a code from an authenticator app, a tap on a push notification, a biometric, or a hardware/passkey proof. The factors must be independent; two things you know don’t add real protection.

Not all MFA is equal

The security of MFA depends entirely on the factors used:

• SMS OTP: better than nothing, but vulnerable to SIM swapping, interception, and phishing. Increasingly discouraged for high-value accounts.
• Authenticator-app TOTP, stronger than SMS, but the code can still be phished in real time via a fake site.
• Push notifications, convenient, but vulnerable to MFA fatigue (prompt bombing), where attackers spam approvals hoping the user taps yes.
• Phishing-resistant MFA (passkeys/FIDO2, hardware keys), the gold standard, because the cryptographic proof is bound to the legitimate site and can’t be replayed or phished.

The rise of MFA bypass

Attackers adapted to MFA rather than giving up on it. Real-time phishing proxies capture both the password and the one-time code and replay them instantly. Prompt bombing exploits user fatigue. SIM swaps defeat SMS. What fails here is the phishable factor, not MFA as a concept, which is why the industry is moving toward phishing-resistant MFA and passwordless.

MFA and user experience

Blanket MFA on every login frustrates customers and drives drop-off. The better model is risk-based: apply strong authentication when risk warrants and stay quiet when it doesn’t. Pairing MFA with a risk engine (stepping up only for anomalous sessions or sensitive actions) delivers strong protection without taxing every legitimate login, which is exactly how orchestration is meant to use it.

MFA bypass techniques, in depth

MFA raised the bar, so attackers built tools to clear it. The main techniques worth knowing:

• Adversary-in-the-middle (AiTM) phishing. A proxy sits between the user and the real site, relaying the login in real time. The victim enters their password and one-time code on a convincing fake page; the proxy forwards both instantly and steals the resulting session. This defeats any MFA the user has to type or approve: SMS, TOTP, and often push.
• Prompt bombing (MFA fatigue). With the password already in hand, the attacker triggers repeated push approvals until the victim taps "approve" out of habit or annoyance.
• SIM swapping. Moving the victim’s number to an attacker-controlled SIM to intercept SMS codes.
• Session/token theft. Stealing an authenticated session cookie (via malware or an AiTM proxy) sidesteps login entirely, the attacker rides the session MFA already blessed.

The common thread: every one of these targets a phishable or replayable factor. None of them work against a passkey, because the cryptographic proof is bound to the real site’s origin and never leaves the device.

Deploying MFA well

Strong MFA is as much about method and timing as about turning it on. Favor phishing-resistant factors (passkeys, hardware keys) for anything high-value, and retire SMS as a primary factor for sensitive accounts. Where you must use push, enable number matching and show rich context so a blind "approve" isn’t enough. Apply MFA through a risk lens rather than universally, so good customers aren’t challenged needlessly while risky sessions meet real resistance. And harden the flows people forget: account recovery and enrollment are where attackers go when the front-door MFA is solid.

Is MFA still worth it if attackers can bypass it?

Yes, decisively. The bypass techniques above are real, but they raise the cost and effort of an attack substantially, and they only work against the phishable forms of MFA. The correct reading of "MFA can be bypassed" isn’t "abandon MFA," it’s "move toward phishing-resistant MFA." An account protected by a passkey is not vulnerable to AiTM phishing, prompt bombing, or SIM swaps, because there’s no code to relay and no push to spam. So the practical progression for most organizations is: MFA everywhere as a baseline, phishing-resistant MFA for anything sensitive, and a plan to make phishing-resistant the default rather than the exception.

Frequently asked questions

What does MFA stand for?

Multi-factor authentication.

Is MFA the same as 2FA?

2FA is a specific case of MFA using exactly two factors; MFA can use two or more.

What is the most secure type of MFA?

Phishing-resistant MFA using passkeys/FIDO2 or hardware security keys.

Can MFA be bypassed?

Phishable forms (SMS, TOTP, push) can be bypassed via real-time phishing, SIM swaps, or prompt bombing; phishing-resistant MFA resists these.

Related: Two-Factor Authentication (2FA) · Passkeys · SMS OTP / SMS 2FA · MFA Fatigue / Prompt Bombing · Risk-Based Authentication · Step-Up Authentication