Yes, attackers can bypass multifactor authentication (MFA), but “bypass” usually means exploiting a weak factor, tricking the user, stealing an already authenticated session, or abusing account recovery—not mathematically breaking every MFA system. SMS codes, approval prompts, passwords and time-based one-time passwords (TOTP) can be phished or relayed. FIDO2 security keys and passkeys use cryptographic proof tied to the legitimate website, so a counterfeit login page cannot obtain a reusable approval. Strong deployment still requires protected enrollment, recovery, devices and session tokens.
What an MFA bypass actually is
MFA asks for two or more independent proofs, such as a password plus a code, a password plus an approval notification, or a passkey plus a local gesture. An attacker does not always need to defeat both factors directly. Common bypasses include capturing the factors as the victim uses them, persuading the victim to approve a login, stealing the session created after MFA, moving a phone number to a new SIM, or taking over recovery and enrollment.
As an Amazon Associate I earn from qualifying purchases.
The security difference is whether the authenticator produces a secret or approval that can be copied and replayed. A password, six-digit code or approval can be relayed through an impostor-controlled login flow. A properly implemented FIDO2 or passkey ceremony proves that the authenticator is talking to the legitimate relying party, so the private key never has to be disclosed to the attacker.
Free tools Windows power users keep installed
One-click scans. No signup required.
Method-by-method comparison
| Attacker method | What it can defeat | What it usually cannot defeat | Best control |
|---|---|---|---|
| Credential phishing | Password plus a code or approval entered into a counterfeit page | A correctly implemented phishing-resistant key or passkey bound to the legitimate service | FIDO2 or passkeys, user training and domain controls |
| Adversary-in-the-middle (AiTM) relay | A live login exchange and, in some deployments, the resulting session token | Origin-bound cryptographic authentication | FIDO2 or passkeys, token protection and conditional access |
| Push bombing (MFA fatigue) | Approval-based push workflows when a user eventually accepts | Flows requiring deliberate number transfer or a secret, plus phishing-resistant methods | Number matching, rate limits, reporting and phishing-resistant MFA |
| SS7 abuse | Codes delivered by SMS or voice over the phone network | App or hardware authenticators that do not depend on phone-network delivery | Remove SMS and voice as the primary factor; use FIDO2 or passkeys |
| SIM swap | SMS or voice codes after a number is moved to an attacker-controlled SIM | Hardware keys and passkeys not tied to a phone number | Carrier account protections plus phishing-resistant MFA |
| Session-token theft | Fresh MFA prompts, because a stolen token may already represent an authenticated session | Tokens bound to the intended device and protected by revocation and conditional access | Token protection, device controls and rapid session revocation |
| TOTP seed or code theft | Time-based one-time-password MFA when the seed or current code is captured | A properly implemented origin-bound FIDO2 or passkey ceremony | Migrate from shared-secret OTP to phishing-resistant methods |
Phishing and adversary-in-the-middle attacks
Credential phishing
A conventional phishing page imitates a real sign-in page and asks for the username, password and six-digit authenticator code. If the victim supplies all three, the attacker has the credentials and a current second factor. The same tactic can capture an approval by telling the victim that a sign-in needs confirmation.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
This attack works because the victim, rather than the authenticator protocol, is deciding where to disclose the secret. Password managers, domain allowlists and user reporting reduce exposure, but they still depend partly on recognizing the impostor.
AiTM relay
An adversary-in-the-middle proxy sits between the victim and the real service. The victim sees a convincing address controlled by the attacker; the proxy forwards the username, password and code or approval to the real service in real time. In deployments where the service issues a browser session token after successful MFA, the proxy can capture that token and use it from another device.
FIDO2 and passkeys address the core problem through origin binding. The authenticator signs a challenge for the legitimate relying party, and a counterfeit domain cannot obtain a valid signature for that service. NIST defines phishing resistance as the ability of an authentication protocol to prevent disclosure of authentication secrets and valid authenticator outputs to an impostor relying party without relying on the subscriber’s vigilance.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Push bombing and MFA fatigue
Push bombing, also called MFA fatigue, sends repeated approval notifications to a target. Attackers may first obtain a password through phishing or a data breach, then trigger dozens of prompts. The goal is annoyance, confusion or a believable pretext such as a help-desk call. One accidental tap can complete the attacker’s login.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Number matching improves this flow by requiring the user to enter a number shown on the sign-in screen instead of simply pressing Accept. It reduces accidental approvals and gives the user more context, but it remains a user-mediated process. It should not be described as equivalent to FIDO2, because a determined attacker can still relay the transaction and persuade a user to transfer the displayed number.
- Reject every unexpected prompt; do not approve one to make notifications stop.
- Report the incident through the organization’s security channel and change the password if it may have been exposed.
- Use number matching, prompt rate limits, risk-based blocking and clear device or location information.
- Prefer a security key or passkey for accounts that protect sensitive data or administrative functions.
SS7 abuse and SIM swapping
SS7 abuse
SMS and voice codes travel through the telephone network. Attackers can exploit weaknesses in Signaling System 7 (SS7), the protocol used by carriers to route calls and messages, to obtain or redirect codes. The attack targets delivery of the code rather than the password or the account’s cryptography.
SIM swapping
In a SIM swap, an attacker persuades a carrier or reseller to transfer the victim’s number to a SIM or eSIM under the attacker’s control. Future text messages and voice calls, including MFA codes, then arrive on the attacker’s device. The victim may discover the takeover only after losing cellular service or seeing unauthorized account activity.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCarrier PINs, port-out locks and in-person identity checks can make a swap harder, but they do not turn SMS into a phishing-resistant factor. A hardware key or passkey is not tied to the phone number and therefore is not directly defeated by SS7 abuse or a SIM swap.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Session-token theft
After successful MFA, a service normally issues a session token stored in the browser or application. That token is proof that authentication already happened. If malware, an AiTM proxy, a malicious browser extension or an exposed endpoint steals it, the attacker may replay the token without triggering a new MFA challenge. Microsoft’s token-protection guidance describes binding tokens to the intended device so a copied token is unusable from an attacker-controlled device.
Token theft changes the response priorities. Signing in again is not enough if the stolen token remains valid. Revoke active sessions, invalidate refresh tokens, remove unknown devices, inspect recent sign-ins and force reauthentication under conditional-access rules. Device health checks, protected browser storage and endpoint detection reduce the chance that tokens can be copied in the first place.
TOTP seed and code theft
Authenticator applications that generate TOTP codes are stronger than SMS in several ways: they do not depend on the carrier network and codes expire quickly. They still use a shared secret, called the seed, that the service and authenticator both know. A phishing page can capture the current code while it is valid, and malware or an exposed backup can steal the seed and generate future codes.
Never enter a TOTP code into a page reached through an unexpected message. Treat a seed export or backup as a credential reset event: revoke the old enrollment, issue a new seed and review sessions. Where supported, migrate the account to a FIDO2 key or passkey rather than adding another shared-secret OTP.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why FIDO2 security keys and passkeys resist phishing
During enrollment, the authenticator creates a public-private key pair for the service. The service stores the public key; the private key remains on the security key, phone or computer’s protected hardware. At sign-in, the service sends a challenge. The authenticator signs it only for the legitimate origin, and the service verifies the signature with the stored public key.
A fake domain can collect a password, but it cannot make the authenticator produce a signature for the real domain. There is no reusable six-digit value for an attacker to relay. This is why CISA places a physical security key first in its practical ordering and says it provides the best protection against phishing.
Passkeys apply the same public-key model through platform credentials or synced credentials, depending on the implementation. They are substantially more resistant to phishing than passwords, SMS and TOTP, but account recovery, device malware and a compromised authenticated session remain separate risks.
Limits that phishing-resistant MFA does not remove
Enrollment and recovery
An attacker who controls a weak recovery email, help-desk process or first-time enrollment can add their own authenticator before the victim enables stronger MFA. Require an already trusted factor for enrollment changes, notify users of new devices, enforce a waiting period for high-risk changes and protect recovery codes like passwords.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Endpoint compromise
Malware on a logged-in computer can read data, alter transactions or use an active browser session even when the sign-in itself was protected by a key. Keep operating systems, browsers and security software updated; use least privilege; remove untrusted extensions; and require managed, healthy devices for sensitive applications.
Account and session policy
Long-lived sessions, unrestricted refresh tokens and missing sign-in risk checks increase the value of a stolen token. Set sensible session lifetimes, revoke tokens after password or factor changes, require step-up authentication for sensitive actions and block impossible travel or unfamiliar device patterns where those signals are reliable.
Which MFA method should you choose?
CISA’s ordering is a practical baseline when an organization can support every option:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems- Physical security key: best protection against phishing and suitable for administrators, finance, identity and other high-impact accounts.
- Authenticator-app number matching: stronger than a simple approve or deny prompt, but still dependent on user judgment.
- App-generated one-time codes: independent of the mobile network, yet vulnerable to phishing and seed theft.
- Biometrics where supported: useful as a local unlock for a device-bound authenticator; biometrics alone are not a remote network factor.
- SMS or email codes: fallback options only when stronger methods are unavailable, because they are the weakest listed choices.
For a personal account, enroll two compatible security keys or a passkey plus a separately stored recovery method before removing weaker factors. For an organization, make phishing-resistant MFA the baseline for administrators and high-value applications, then use number matching or app OTP as transitional coverage for users or systems that cannot yet support keys.
Quick Recap
Deployment checklist
- Inventory every sign-in, privileged account, service account and recovery path.
- Remove SMS and voice as primary factors wherever a security key, passkey or authenticator app is supported.
- Require phishing-resistant authentication for administrators and users handling sensitive data.
- Enable number matching, prompt throttling and user reporting for remaining push workflows.
- Protect enrollment with an existing trusted factor and alert on new authenticator registration.
- Store recovery codes offline, limit help-desk resets and log every recovery event.
- Enable token protection or device-bound sessions where the identity platform supports them.
- Apply device health, browser and conditional-access controls to reduce session-token theft.
- Test account recovery and emergency access before enforcing a new policy.
- Run simulations that teach users to deny unexpected prompts and report them immediately.
What to do after a suspected bypass
- Disconnect the affected device from sensitive services if malware or token theft is possible.
- Revoke all active sessions and refresh tokens, not just the password.
- Change the password from a trusted device and replace any exposed TOTP seed.
- Check authenticator enrollment, recovery addresses, forwarding rules, OAuth grants and new devices.
- Contact the carrier immediately if service was lost or a SIM swap is suspected, then add a port-out lock.
- Review sign-in logs for unfamiliar locations, user agents, consent grants and data access.
- Re-enroll a phishing-resistant key or passkey and remove unknown authenticators.
- Preserve logs and report the incident through the organization’s established security process.
Common misconceptions
- “MFA means an account cannot be hacked.” MFA raises the barrier; it does not protect a stolen session token or weak recovery process.
- “Any two factors are equally strong.” SMS, TOTP, push approval and cryptographic origin-bound authentication have different attack surfaces.
- “Number matching is phishing-proof.” It reduces accidental approval but still relies on a user-mediated exchange.
- “A SIM swap defeats every second factor.” It targets SMS and voice delivery, not a hardware key or passkey.
- “A one-time code cannot be stolen.” A code can be relayed during its short validity window, and its seed can be copied for future codes.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
