What is multi-factor authentication (MFA)?

How MFA works: The three factor types

MFA is built on the idea of combining factors from different categories, because factors of the same kind share the same weaknesses. Most methods draw on one of three types.

A genuine second factor has to come from a different category. A password plus a security question is not real MFA, since both are things you know and both can be phished or guessed. Newer approaches add context as a further signal: location-based checks look at where a request comes from, and adaptive or risk-based authentication weighs signals such as device, time, and network to decide whether to ask for an extra factor or block the attempt outright.

Common MFA methods

In practice, organizations and services use a range of MFA methods that differ significantly in convenience and in strength:

• SMS or email one-time passcodes, short codes sent to a phone or inbox. Easy to use and better than nothing, but the weakest common method.
• Authenticator app codes (TOTP), time-based codes generated by an app such as those from Google or Microsoft, valid for around 30 seconds. Stronger than SMS because there is no message to intercept.
• Push notifications, a prompt to a trusted device that the user approves. Convenient, but exposed to fatigue attacks described below.
• Hardware and software tokens, devices or apps that generate a code or respond to a challenge.
• Biometrics, a fingerprint, face, or voice, often used to release a stronger underlying credential.
• Security keys and passkeys, hardware keys and device-bound credentials built on FIDO2 and WebAuthn, the strongest widely available option.

MFA vs 2FA

MFA and two-factor authentication (2FA) are often used interchangeably, and the difference is small but worth stating clearly. 2FA requires exactly two factors, for example a password plus a code from an app. MFA is the umbrella term for any scheme that uses two or more. So all 2FA is MFA, but MFA can also involve three or more factors. In everyday use, when a service asks for a password and one additional factor, that is 2FA, and it is a form of MFA.

How attackers bypass weak MFA

MFA raises the bar, but attackers have learned to clear the lower versions of it. This is the part many organizations miss: enabling MFA is not the same as being protected, because the method matters. Research has repeatedly found that most breached organizations already had some MFA in place. The common bypass techniques:

• MFA fatigue (push bombing). The attacker, already holding the password, triggers a flood of push prompts until the user approves one out of annoyance or by mistake.
• Adversary-in-the-middle (AiTM) phishing. A reverse-proxy phishing kit sits between the user and the real site, relaying the login and the MFA step in real time, then steals the resulting session token. Toolkits such as Evilginx and Tycoon have made this routine, and it now starts a large share of business email compromise cases.
• SIM swapping. The attacker takes over the victim's phone number to receive SMS codes, which is why SMS is the weakest factor.
• Session hijacking and OAuth consent phishing. Stealing an active session cookie, or tricking a user into granting a malicious app, sidesteps the login entirely.

What these share is that the user's approval is not tied to the real destination. A code or a push can be relayed, replayed, or coaxed out of a person. That weakness is exactly what the next generation of MFA is designed to remove.

Phishing-resistant MFA

Phishing-resistant MFA is any method that cannot be captured and replayed by a phishing site or relayed by an attacker in the middle, because the authentication is cryptographically bound to the legitimate site. The two forms recognized by CISA and NIST are FIDO2 and WebAuthn (the basis for security keys and passkeys) and PKI-based authenticators such as PIV or CAC smart cards. In these schemes a private key never leaves the user's device and the authentication challenge is tied to a specific web origin, so if a user lands on a look-alike phishing domain, the authenticator simply will not produce a valid response.

This is why passkeys and hardware security keys are now considered the standard to aim for, and why regulators and agencies increasingly push organizations toward them for sensitive systems. The tradeoff is practical: hardware procurement, device and browser support, and account-recovery planning all take work, so many organizations phase phishing-resistant MFA in for high-risk users first. Even so, no authentication method removes social-engineering risk entirely, which is why detection still matters alongside prevention.

MFA best practices

Getting value from MFA is about how it is deployed, not just whether it is enabled:

1. Prefer phishing-resistant methods. Move toward FIDO2 security keys and passkeys, especially for administrators and other high-value accounts, and treat SMS as a last resort.
2. Apply MFA everywhere it counts. Enforce it consistently across applications, remote access, and privileged accounts, since one unprotected entry point undermines the rest.
3. Use number matching and limits on push. Where push is still used, number matching and prompt limits blunt fatigue attacks.
4. Plan for lost factors. Have secure recovery procedures for a lost phone or key, because weak recovery is itself a bypass route.
5. Pair MFA with monitoring. Because strong MFA can still be worn down by social engineering, watch authentication activity for the signs of a bypass in progress.

Expert insight: MFA prevents, detection catches the bypass

MFA is a preventive control, and a very good one. It closes off the simplest and most common route into an account, which is a stolen or guessed password. But the attacks that matter most now are the ones built specifically to get past it, and when they succeed, the login itself looks legitimate. An attacker who relays a session token through an adversary-in-the-middle kit, or who finally wins a push-fatigue battle at 2 a.m., arrives inside the account as an authenticated, MFA-satisfied user. The identity provider sees nothing wrong.

That is the gap detection fills, and where Sekoia fits. Sekoia is a European cybersecurity vendor, and its unified AI SOC platform ingests authentication and identity signals, sign-in logs, MFA events, new device registrations, session activity, and correlates them with endpoint, network, and cloud telemetry to catch the fingerprints of an MFA bypass after the fact. A sign-in from an unexpected location moments after a burst of denied push prompts, a session token used from a new device and network, an out-of-pattern spike in privileged access: these are visible when identity data is analyzed in context, and they map to the MITRE ATT&CK framework so an analyst can connect the authentication anomaly to the wider intrusion.

To be clear about scope, Sekoia does not provide MFA and is not an identity provider; deploying and enforcing MFA is the job of an IAM or identity platform. What a threat detection and response platform adds is the layer above the login: spotting when a satisfied MFA prompt was actually an attacker, so a bypassed control becomes a detected intrusion rather than a silent breach. As a European vendor with a data-sovereignty posture, Sekoia also suits organizations that need identity and security data handled under European governance.