Multi-factor authentication requires two or more independent factors: something you know, something you have, and something you are. It sharply cuts account takeover from stolen passwords alone, but it is not bulletproof, and the weakest factors are the ones fraudsters attack most.
What is MFA, in plain English?
Multi-factor authentication requires a user to prove who they are with two or more independent factors drawn from different categories: something you know like a password, something you have like a phone or hardware token, and something you are like a fingerprint or face. The point is independence: stealing one factor should not be enough, because the attacker still lacks the other.
Its main win is against stolen passwords. Because breached and phished passwords are everywhere, a login protected only by a password is easy to take over. Adding a second factor means the password alone no longer opens the door, which sharply cuts account takeover from credential theft.
But MFA is not bulletproof, and the details matter. SIM swaps, intercepted one-time codes, real-time phishing proxies, and push-bombing that wears a user into approving all defeat weaker forms of it. In fraud and AML, the guidance is to prefer phishing-resistant factors like passkeys or hardware keys over SMS codes, and to watch the enrollment and reset flows where fraudsters swap factors.
The three factor types
Factor | What it is and how it fails |
Something you know | Passwords and PINs; widely phished and breached, the weakest on its own. |
Something you have | Phones, tokens, passkeys; strong when phishing-resistant, weaker as SMS codes. |
Something you are | Fingerprint or face; strong with liveness, spoofable without it. |
The combination | Two independent factors so one stolen credential is not enough to log in. |
Who is involved?
Who | Their role |
The user | Enrolls factors and presents them at login or step-up. |
The security team | Chooses which factors to allow and hardens enrollment and reset flows. |
The fraud team | Watches for SIM swaps, push-bombing, and factor-swap attempts around resets. |
The attacker | Targets the weakest allowed factor: SMS codes, push fatigue, or a phishing relay. |
What it looks like in practice
In practice
A customer has a strong password and SMS-based MFA. A fraudster who phished the password calls the mobile carrier, poses as the customer, and moves the number to a new SIM. The next login prompt sends the one-time code straight to the attacker's phone, and both factors are now in their hands.
The takeover succeeds not because MFA failed as a concept but because the second factor, an SMS code, was tied to a phone number that could be hijacked. When the same account is later moved to a passkey, a repeat attempt stalls: there is no code to intercept and no number to swap. The factor choice, not the presence of MFA, decided the outcome.
Why it matters to operators
MFA is the highest-leverage control against the most common attack, which is a stolen password reused at login. Turning it on meaningfully raises the cost of account takeover and is often the single biggest improvement a team can make to login security. That is why it is close to mandatory for anything sensitive.
The nuance is that not all MFA is equal. SMS codes and simple push approvals fall to SIM swaps, real-time phishing proxies, and push-bombing, so treating MFA as a checkbox invites a false sense of safety. Prefer phishing-resistant factors like passkeys and hardware keys, and pay special attention to enrollment and reset flows, because that is where fraudsters swap a strong factor for one they control.
What to watch in the data
- Recent SIM change. A number ported or swapped shortly before a login or reset is a classic takeover setup.
- Push-bombing. A flood of approval prompts in a short window suggests an attacker trying to wear the user down.
- Factor swap at reset. A strong factor removed and a weaker one added during recovery is a common takeover move.
- Real-time relay signs. Codes entered within seconds from a mismatched device or location can indicate a phishing proxy.
- SMS as the only second factor. Sensitive actions protected solely by SMS codes are exposed to interception and SIM swaps.
Quick questions
Does MFA stop account takeover completely?
No. It sharply reduces takeover from stolen passwords, but SIM swaps, intercepted codes, real-time phishing proxies, and push-bombing can defeat weaker forms. It raises the bar significantly without being absolute.
What is a phishing-resistant factor?
One that cannot be relayed to a fake site, like a passkey or a hardware security key bound to the real domain. Unlike an SMS code, there is nothing for the user to read out or an attacker to replay.
Why is SMS a weak second factor?
Because the code can be intercepted through SIM swaps, malware, or real-time phishing that relays it instantly. The factor is tied to a phone number, which a fraudster can hijack through the carrier.
What is push-bombing?
It is when an attacker who already has the password triggers repeated approval prompts, hoping the user taps approve out of annoyance or confusion. Number matching and rate limits on prompts help defend against it.
Why watch enrollment and reset flows?
Because that is where factors are added, removed, or changed. A fraudster who takes over recovery can swap a strong factor for one they control, so those flows need the same or stronger protection as login itself.
Go deeper
- NIST Digital Identity Guidelines (SP 800-63) ↗ — The US standard for identity proofing and authentication assurance levels.
- FATF ↗ — The global standard-setter for AML, counter-terrorist-financing, and counter-proliferation. Recommendations, guidance, and jurisdiction lists.