What is multi-factor authentication? How MFA works and where it fails

Multi-factor authentication (MFA) is a login method that asks for at least two different kinds of proof before it lets you in: something you know, such as a password, plus something you have, such as your phone, or something you are, such as your fingerprint. A stolen password alone is then no longer enough to take over an account. That makes MFA one of the most effective security measures an organisation can switch on.

But MFA is not a force field. Attackers have learned to bombard employees with login requests until someone taps “approve”, to steal session cookies through fake login pages and to talk helpdesks into resetting a phone number. This article explains how MFA works, which forms are strong and which are weak, how attackers get around it and what regulators in the UK, the EU and the US expect.

How multi-factor authentication works

Every login factor belongs to one of three categories. MFA only counts as multi-factor when the factors come from different categories; two passwords are still one factor.

• Something you know. A password, PIN or answer to a security question.
• Something you have. A phone with an authenticator app, a hardware security key or a smart card.
• Something you are. A fingerprint, face scan or other biometric feature, usually checked on your own device.

Two-factor authentication (2FA) is simply MFA with exactly two factors, and in practice the terms are used interchangeably. What matters more than the number of factors is how resistant each factor is to phishing and manipulation.

Forms of MFA, from weakest to strongest

1. SMS and voice codes. Better than a password alone, but vulnerable to SIM swapping, where a criminal convinces a mobile operator to move your number to their SIM card.
2. Email codes. Only as secure as the mailbox, which is often protected by the same password the attacker already has.
3. Authenticator app codes. A six-digit code that changes every 30 seconds. Much stronger than SMS, but an employee can still type it into a fake login page.
4. Push notifications with number matching. The app asks you to confirm the login and type the number shown on screen. That stops blind approvals, although a determined attacker can still try to talk someone through it.
5. Passkeys and security keys. Based on the FIDO2 standard, they only work on the real website, so a phishing page gets nothing. This is what security agencies call phishing-resistant MFA.

How attackers get around MFA

• MFA fatigue. With a stolen password, the attacker triggers login request after login request, often at night, until the employee approves one just to make the notifications stop.
• Adversary-in-the-middle phishing. A fake login page passes everything through to the real site in real time, including the MFA code, and steals the session cookie that keeps the victim logged in. Our overview of types of phishing attacks shows how convincing these pages have become.
• SIM swapping. The attacker takes over the victim’s phone number and receives the SMS codes.
• Helpdesk social engineering. A caller poses as an employee who “lost their phone” and asks the IT helpdesk to register a new device. It works surprisingly often, because helpdesks are trained to help.

What these techniques have in common is that they do not break the technology. They persuade a person to let the attacker through. That is why MFA and awareness belong together.

MFA fatigue: when an employee approves the attacker

MFA fatigue, also called push bombing, became widely known in 2022, when an attacker got into Uber’s network this way. After a flood of push requests, the attacker contacted the employee on WhatsApp, posing as IT support, and said the notifications would stop once one was approved. The employee approved, and the attacker was in.

The defence is partly technical and partly human. Number matching and limits on repeated requests make the attack harder. Just as important is a simple rule every employee knows by heart: never approve a login you did not start yourself, and report unexpected MFA requests straight away, because they mean someone already has your password.

What regulators expect: MFA in the UK, the EU and the US

• United Kingdom. Cyber Essentials requires MFA for cloud services wherever it is available, and the NCSC recommends it for all important accounts.
• European Union. NIS2 explicitly lists multi-factor authentication among the security measures that essential and important entities have to consider, and GDPR expects appropriate technical measures to protect personal data.
• United States. CISA urges organisations to move to phishing-resistant MFA, and the FTC Safeguards Rule requires MFA for many financial businesses that handle customer data.

The direction is the same everywhere: MFA is becoming a baseline, and regulators increasingly ask not only whether it is switched on, but whether it resists phishing and whether employees know how to use it safely.

How to roll out MFA in five steps

1. Start with the accounts that matter most. Email, remote access, admin accounts, finance systems and anything reachable from the internet.
2. Choose the strongest method people will actually use. Authenticator apps with number matching as the standard, passkeys or security keys for administrators and high-risk roles.
3. Harden the helpdesk. Agree how someone proves their identity before a device is reset or re-registered, and stick to it, also for the CEO.
4. Explain the why and the rules. Employees who understand MFA fatigue and fake login pages recognise an attack when they see one.
5. Monitor and keep training. Watch for repeated failed or declined MFA requests, and keep the rules fresh with short, recurring training.

The tip: train the human side of MFA with Guardey

Guardey makes sure employees know what to do when MFA is put to the test. Every week they get a challenge of about three minutes, on their laptop or in the mobile app for iOS and Android, on topics like unexpected login requests, fake login pages, helpdesk scams and password hygiene. Gamification with leaderboards and streaks keeps people involved, phishing simulations test whether they spot a fake login page and audit-ready reporting shows your progress for NIS2 and ISO 27001. More than 500 organisations, including the European Parliament, already use Guardey. See how our security awareness training works.

Working with an IT partner? Ask about more than switching MFA on

Many organisations have their Microsoft 365 accounts, devices and security managed by a managed service provider (MSP): an IT company that runs IT for other businesses for a monthly fee. For most MSPs, rolling out MFA is routine work. Yet the attacks that get past MFA target the people using it, not the configuration. If an MSP manages your IT, ask how they protect you against MFA fatigue and fake login pages. For MSPs, training is the natural second half of an MFA service.

One of the ways MSPs can offer Guardey is through e92plus, a cybersecurity distributor whose portfolio also covers identity, access and password management. Its in-house engineers support partners from demo to deployment, so authentication and awareness can be sold and delivered as one service.

Frequently asked questions about multi-factor authentication

Is MFA the same as 2FA?

Almost. Two-factor authentication uses exactly two factors, while multi-factor authentication can use two or more. In everyday use the terms mean the same thing: a second proof of identity on top of your password.

Can MFA be hacked?

MFA itself is rarely cracked, but it can be bypassed. The most common methods are MFA fatigue, fake login pages that steal session cookies, SIM swapping and tricking a helpdesk. Phishing-resistant methods such as passkeys, combined with trained employees, stop most of these attacks.

What is MFA fatigue?

MFA fatigue is an attack in which a criminal who already has someone’s password sends repeated login requests until the victim approves one out of annoyance or confusion. The rule that stops it is simple: never approve a request you did not trigger yourself, and report it.

What is phishing-resistant MFA?

Phishing-resistant MFA uses passkeys or hardware security keys based on the FIDO2 standard. The login is cryptographically tied to the real website, so a fake page cannot capture anything usable. Security agencies such as CISA and the NCSC recommend it, especially for administrators.

MFA remains one of the best investments in security an organisation can make. It just works best when the people tapping “approve” know when not to.