What is Multi-Factor Authentication (MFA)?
Multi-factor authentication has been the single most-recommended security control of the past decade. Cybersecurity guidance from CISA, NIST, the FBI, and virtually every security vendor leads with the same message: turn on MFA. Cyber insurance carriers require it. Compliance frameworks expect it. Most security professionals consider it the highest-leverage security investment most organizations can make.
All of that is still true. But the conversation has shifted: not all MFA is created equal anymore. Attackers have adapted. The MFA that protected accounts effectively five years ago can now be bypassed routinely by motivated threat actors. The question we used to ask was simple: “do you have MFA?” Nowadays it’s important to ask, “do you have phishing-resistant MFA on the accounts that matter most?”
This guide explains what MFA actually is, the different methods and their security tradeoffs, why “phishing-resistant” has become the new standard, and how to think about MFA strategy for your organization.
Quick takeaway: MFA is the single highest-impact security control for most organizations, but the type of MFA you use matters significantly. SMS and basic authenticator apps protect against opportunistic attacks but can be bypassed by determined attackers. Phishing-resistant MFA (FIDO2 keys, passkeys, certificate-based authentication) prevents most modern attack techniques. The right strategy: strong MFA everywhere, phishing-resistant MFA on privileged and high-risk accounts.
What Is Multi-Factor Authentication?
Multi-factor authentication is a security mechanism that requires users to verify their identity using two or more separate factors before being granted access. The “factors” come from three categories:
- Something you know – a password or PIN
- Something you have – a phone, security key, or token
- Something you are – a fingerprint, face scan, or other biometric
By requiring factors from at least two different categories, MFA dramatically reduces the risk that a stolen password alone leads to account compromise. An attacker who phishes your password still can’t log in without your phone, your security key, or your face.
The terms “MFA” and “two-factor authentication (2FA)” are often used interchangeably, though MFA technically refers to any number of factors greater than one.
How MFA Actually Works in Practice
When MFA is enabled, the typical login flow looks like:
- User enters their username and password (factor 1: something they know)
- The system prompts for additional verification (factor 2: something they have or are)
- User completes the second factor, such as entering a code, approving a push notification, tapping a security key, or providing a biometric
- The system verifies the second factor and grants access
The specific implementation varies based on the MFA method. Some methods are easier to use; others are harder to bypass. Most organizations use different approaches for different scenarios, like having easier methods for routine access and stronger methods for sensitive systems.
Common MFA Methods and Their Security
Not all MFA methods provide equal protection. Understanding the spectrum is essential to making good decisions about where to use which method.
SMS-Based MFA
How it works: A code is texted to the user’s phone after password entry. User enters the code to complete login.
Pros: Easy to deploy and use, familiar to users, and supported by most platforms.
Cons: Vulnerable to SIM swapping (where attackers transfer your phone number to their device), SS7 attacks (telecom protocol weaknesses), and phishing (where attackers prompt users for the code). NIST has explicitly recommended against SMS for high-security applications.
When it’s appropriate: General consumer accounts, low-sensitivity business accounts. NOT appropriate for privileged accounts, accounts with access to sensitive data, or organizations facing elevated threat profiles.
Authenticator App (Time-Based One-Time Password / TOTP)
How it works: An app (Microsoft Authenticator, Google Authenticator, Authy) generates a 6-digit code that changes every 30 seconds. User enters the current code to complete login.
Pros: Stronger than SMS, works offline, and phone-based without requiring cellular service.
Cons: Still vulnerable to phishing (attackers can prompt users for the current code on a fake login page). Susceptible to malware on the phone. The user can be tricked into entering the code on an attacker’s site.
When it’s appropriate: Standard business accounts, applications without truly sensitive access, situations where stronger methods aren’t yet practical.
Push Notification (App-Based)
How it works: When the user attempts to log in, a notification is sent to their authenticator app. User approves the login attempt by tapping a button.
Pros: More user-friendly since there are no codes to type and quicker than entering codes. Provides some context about the login attempt (location, application).
Cons: Vulnerable to “MFA fatigue” or “MFA bombing” attacks where attackers send repeated push notifications hoping the user will eventually approve one out of frustration. Phishing remains a concern if push approval doesn’t include sufficient context.
When it’s appropriate: Standard business accounts where users find code entry friction. Should be configured with number matching (where the user must verify a number shown on the login screen) to prevent fatigue attacks.
Push Notification with Number Matching
How it works: When the user attempts to log in, a number is displayed on the login screen. The push notification asks the user to enter that number in the app to approve. Without the number from the actual login attempt, push approval doesn’t work.
Pros: Significantly reduces MFA fatigue attacks and provides clear context for each login attempt. Microsoft has made this the default for Microsoft Authenticator.
Cons: Slightly more friction than basic push. Still vulnerable to sophisticated phishing where the attacker relays the number through their phishing site, though it is much harder.
When it’s appropriate: Standard business accounts, especially where users have been confused by previous push attacks. A meaningful improvement over basic push.
Hardware Security Keys (FIDO2 / WebAuthn)
How it works: A physical device (typically a USB-A, USB-C, NFC, or Lightning key) is registered to user accounts. To authenticate, the user inserts the key and taps a button.
Pros: Phishing-resistant by design. The key cryptographically validates the actual website domain meaning even a perfect phishing replica can’t trick the key. There are no codes to phish and it is resistant to most modern attack techniques.
Cons: Requires physical hardware (cost: $25-$80 per key), users can lose keys, and some applications don’t yet support FIDO2.
When it’s appropriate: Privileged accounts (admin, domain admin, root), accounts with access to sensitive data, executive accounts, and compliance-driven scenarios. This is increasingly recommended for all employees in security-conscious organizations.
Passkeys
How it works: A relatively newer standard built on FIDO2 that uses cryptographic keys stored on user devices (phones, laptops) where authentication happens through device biometrics (Face ID, Touch ID, Windows Hello) and cryptographic verification.
Pros: Phishing-resistant like hardware keys but without requiring separate hardware, user experience is significantly better than passwords or codes, and they are synced across user devices through their cloud account.
Cons: Passkey support is still expanding across applications, recovery scenarios require careful planning, and cross-platform usage can be complex.
When it’s appropriate: Increasingly the right answer for both consumer and business scenarios. Many organizations are deploying passkeys broadly as the new authentication standard.
Biometrics
How it works: Authentication using fingerprint, face scan, iris scan, or other biological characteristics.
Pros: Excellent user experience, hard to forget or lose, and very fast.
Cons: Biometrics alone are insufficient – they’re typically used as just one factor in MFA. Additionally there are privacy considerations and not all environments support biometrics universally.
When it’s appropriate: As one factor in MFA, particularly on user devices. Often combined with FIDO2/passkeys for the strongest authentication experience.
Certificate-Based Authentication
How it works: Digital certificates installed on devices verify both user identity and device identity. Authentication uses cryptographic certificate validation rather than passwords or codes.
Pros: Phishing-resistant, strong cryptographic foundation, and can verify both user and device.
Cons: Complex to deploy and maintain, requires certificate management infrastructure, and is mostly suited to organizations with mature IT operations.
When it’s appropriate: Highly regulated environments, defense contractors, government, and organizations with mature certificate management capabilities.
Why Basic MFA Isn’t Enough Anymore
For years, simply turning on MFA was the gold standard advice. That advice is changing because attackers have adapted.
Modern MFA bypass techniques
Adversary-in-the-middle (AITM) phishing: Attackers create proxy websites that sit between the user and the legitimate service. The user enters credentials and MFA codes on the proxy site, which forwards them to the real service in real time and captures the resulting session token. This bypasses TOTP, SMS, and basic push MFA.
MFA fatigue (push bombing): Attackers who have stolen credentials send repeated push notification requests, hoping the user will eventually approve one out of confusion or annoyance. Without number matching, basic push notifications are vulnerable to this attack.
SIM swapping: Attackers convince mobile carriers to transfer a target’s phone number to a SIM the attacker controls, then receive SMS codes intended for the victim. This has been used in numerous high-profile breaches.
Token theft: After successful authentication, the user’s session token can be stolen from their device through malware, browser exploits, or social engineering. Once stolen, the token can be used directly without going through MFA again.
Help desk social engineering: Attackers contact IT help desks impersonating users, often providing enough personal information to convince the help desk to reset MFA or provide alternative access.
Recovery flow exploitation: MFA recovery procedures (when users lose their device) often have weaker authentication than the primary MFA flow. Attackers exploit recovery procedures to bypass MFA entirely.
What attacks look like in practice
A typical modern attack against an organization with basic MFA:
- Attacker phishes the user’s password through a convincing email
- User enters password on the attacker’s proxy site (which looks like the real login page)
- User receives an MFA push notification or types in their TOTP code
- The proxy site captures the credentials and MFA approval
- The attacker is logged into the real service with a valid session token
This attack succeeds against SMS, TOTP, and basic push MFA. It succeeds even when the user is being careful because everything looks normal to them. The attacker now has authenticated access to the user’s account.
This is why “phishing-resistant” MFA has become the new standard for accounts that matter.
What Is Phishing-Resistant MFA?
Phishing-resistant MFA refers to authentication methods that cannot be bypassed by current phishing techniques. The defining characteristic: the authentication factor cryptographically validates the actual website domain, so even a perfect phishing replica fails.
The methods that qualify
CISA, NIST, and the major cybersecurity guidance bodies generally recognize the following as phishing-resistant:
- FIDO2 / WebAuthn hardware security keys (YubiKey, Feitian, Google Titan, etc.)
- Passkeys (built on FIDO2)
- Certificate-based authentication (when properly implemented)
These methods share a common security property: the authentication is cryptographically bound to the legitimate website. If an attacker creates a phishing site, the user’s authenticator simply won’t authenticate there. If there’s no code to phish, there’s no approval to confuse the user with.
Methods that don’t qualify
The following are NOT phishing-resistant under modern definitions:
- SMS codes
- Email codes
- Voice call MFA
- TOTP authenticator apps (Google Authenticator, Microsoft Authenticator without number matching)
- Basic push notifications
- Security questions
- Knowledge-based authentication
These methods all involve secrets or approvals that can be relayed through phishing infrastructure.
When phishing-resistant MFA matters most
Not every account needs phishing-resistant MFA. The accounts that do:
- Privileged accounts – domain admins, root accounts, security accounts
- Executive accounts – leaders frequently targeted in business email compromise
- Finance and treasury accounts – accounts that can authorize wire transfers or large payments
- Cloud platform admins – AWS, Azure, Google Cloud administrative access
- Backup system admins – backups are a primary ransomware target
- Identity provider admins – accounts that can change MFA configuration or grant access
- Anyone with broad access to sensitive data – engineering, HR with HR system access, healthcare admins with EHR access
Many organizations are deploying phishing-resistant MFA more broadly to all employees instead of just privileged accounts. The economics support this: hardware key costs have come down, and passkeys eliminate the hardware requirement entirely.
Compliance and Regulatory Drivers for Phishing-Resistant MFA
Several regulatory frameworks and major guidance bodies are now explicitly calling for phishing-resistant MFA:
Federal guidance
- CISA has issued multiple advisories specifically calling for phishing-resistant MFA on privileged accounts
- NIST SP 800-63B describes authenticator strength levels with phishing resistance as the highest tier
- OMB Memorandum M-22-09 required federal agencies to deploy phishing-resistant MFA
Industry-specific requirements
- CMMC and NIST 800-171 controls increasingly emphasize strong authentication.
- PCI DSS 4.0 has tightened authentication requirements significantly
- FFIEC guidance for financial institutions has been updated to address modern authentication
Cyber insurance
Cyber insurance carriers are increasingly distinguishing between basic MFA and phishing-resistant MFA in underwriting. Some carriers offer premium discounts for phishing-resistant MFA deployment; others are excluding coverage for compromises involving non-phishing-resistant MFA on privileged accounts. See our Cyber Insurance Requirements Checklist.
Healthcare
While HIPAA doesn’t specifically name phishing-resistant MFA, OCR’s interpretation of “reasonable and appropriate” safeguards is evolving. See our HIPAA Compliance as a Service for current healthcare expectations.
A Practical MFA Strategy for Small and Mid-Sized Organizations
Building an MFA strategy doesn’t have to be complicated. A practical approach:
Tier 1: Strong MFA on everything
There should be some form of MFA stronger than just passwords on every employee account, every system access, and every application. SMS is acceptable as a starting point but should be replaced with stronger methods on a planned timeline. Authenticator apps with number matching are typically the right baseline for general business use.
Tier 2: Phishing-resistant MFA on privileged and high-risk accounts
Move privileged accounts, executive accounts, finance accounts, and accounts with broad data access to FIDO2 keys or passkeys. Document the policy. Track exceptions. Plan for replacement keys, recovery procedures, and offboarding.
Tier 3: Phishing-resistant MFA broadly
Where economics allow, deploy phishing-resistant MFA across the broader employee base. Hardware keys cost $25-$80 per key; passkeys are free. The investment is small relative to the security improvement.
Specific deployment considerations
Microsoft 365 environments: Microsoft has built strong phishing-resistant MFA into the platform. Conditional access can require phishing-resistant authentication for privileged actions while allowing other methods for routine access.
Cloud platforms (AWS, Azure, GCP): Hardware MFA for root accounts. Phishing-resistant MFA for IAM admins. Strong MFA for general user access.
VPN and remote access: Phishing-resistant MFA strongly recommended. VPN access is a frequent target.
Backup systems: Phishing-resistant MFA on backup admin accounts. Backup credentials should be isolated from primary domain credentials.
Help desk and recovery procedures: Authentication for password resets and MFA recovery should be at least as strong as the protected resource. Otherwise, recovery becomes the weak link.
Training matters too
The strongest MFA can be undermined by social engineering at the human layer. Training should specifically cover:
- How AITM phishing attacks work
- What MFA fatigue/bombing looks like
- How to recognize and report MFA-related threats
- What phishing-resistant authentication feels like (it’s actually easier, not harder)
- Recovery procedures and how to verify legitimate help desk requests
How CIT Implements Modern MFA
CIT helps organizations deploy and manage MFA, including phishing-resistant authentication, as part of broader Managed Cybersecurity Services.
What’s included:
- MFA strategy development – appropriate methods for different account types and risk levels
- Microsoft 365 MFA implementation – conditional access, phishing-resistant MFA on privileged accounts
- Training and awareness – making sure employees understand the why, not just the how
- Ongoing monitoring – through CIT’s SOC and MDR services, watching for MFA bypass attempts and unusual authentication patterns
CIT supports MFA modernization across healthcare, education, financial services, government, manufacturing, and non-profits in Minnesota, Wisconsin, and Iowa.
Frequently Asked Questions
What does MFA stand for?
MFA stands for Multi-Factor Authentication. It’s also called two-factor authentication (2FA) when exactly two factors are used. The terms are often used interchangeably.
Is MFA the same as 2FA?
Functionally similar in that both require more than just a password. MFA technically encompasses any combination of two or more factors; 2FA specifically refers to two factors. For many practical purposes, the terms are interchangeable.
Why is SMS-based MFA considered weak?
SMS is vulnerable to SIM swapping, SS7 telecom protocol attacks, and phishing relay attacks. NIST has explicitly recommended against SMS for high-security applications. SMS is better than no MFA but should be replaced with stronger methods as soon as practical.
What is the strongest type of MFA?
FIDO2 hardware security keys and passkeys are currently the strongest widely-deployed MFA methods. Both are phishing-resistant. They cryptographically validate the actual website domain, preventing phishing attacks that bypass other MFA methods.
What is MFA fatigue?
MFA fatigue (also called MFA bombing or push bombing) is an attack where adversaries send repeated push notification requests hoping the user will eventually approve one out of confusion or annoyance. The mitigation is push notifications with number matching, where the user must verify a specific number from the login screen.
What is a passkey?
A passkey is a phishing-resistant authentication credential built on FIDO2 standards. Unlike traditional passwords, passkeys are cryptographic key pairs stored on user devices. They authenticate using device biometrics (Face ID, Touch ID, Windows Hello) and cryptographic verification. No codes to type means no passwords to phish.
Do I need MFA on all my accounts?
Yes. MFA should be enabled on every account that supports it, particularly for business and sensitive personal accounts. The specific MFA method matters; consider stronger methods for higher-risk accounts.
Will MFA slow down my employees?
Modern MFA methods are minimal friction. Push notifications with number matching add a few seconds. Passkeys with biometrics often feel faster than typing passwords. Hardware keys take seconds to use. The productivity impact is minimal compared to the breach prevention.
What happens if I lose my MFA device?
Recovery procedures should be documented and pre-arranged. Common approaches: backup MFA methods (multiple registered devices), recovery codes (printed and stored securely), help desk verification with strong identity proofing. Recovery procedures should be at least as secure as the primary MFA otherwise they create a weak link.
Is MFA required for compliance?
Increasingly, yes. HIPAA, PCI DSS 4.0, CMMC, NIST 800-171, GLBA, and most other major frameworks effectively require MFA. Many require phishing-resistant MFA for privileged access. Cyber insurance carriers also increasingly require MFA as a condition of coverage.
Can MFA be bypassed?
Basic MFA methods (SMS, TOTP, basic push) can be bypassed by sophisticated attackers using AITM phishing, MFA fatigue, SIM swapping, token theft, and other techniques. Phishing-resistant MFA (FIDO2 keys, passkeys, certificate-based authentication) is significantly harder to bypass. No security control is perfect, but phishing-resistant MFA is dramatically more resilient than older methods.
Should small businesses use MFA?
Absolutely. Small businesses face the same MFA threats as large organizations and often have weaker overall defenses, making MFA more important, not less. The good news: MFA deployment for small businesses has gotten easier – Microsoft 365 includes MFA at no additional cost, and most major platforms support it.
Wondering if your MFA is actually keeping you safe?
A 30-minute conversation can clarify which accounts are protected, where your MFA might be vulnerable to modern attacks, and what a sustainable improvement plan looks like. Start with a free Cybersecurity Gap Analysis that includes authentication review.