Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallMulti-factor authentication (MFA) still blocks many account-takeover attempts, but it is not one uniform security level. Attackers are bypassing weaker implementations through adversary-in-the-middle phishing, push-notification fatigue, SIM swaps, SS7 abuse and theft of already-authenticated session tokens. The strongest general direction is phishing-resistant authentication—FIDO2/WebAuthn security keys or passkeys—combined with controls that protect sessions after sign-in.
How attackers are bypassing MFA
MFA adds another proof of identity, but the protection depends on whether that proof can be phished, redirected through a telecom provider or replayed after login. The Cybersecurity and Infrastructure Security Agency (CISA) identifies phishing, push bombing, SS7 exploitation and SIM swapping as weaknesses affecting some MFA methods. Its guidance recommends moving toward phishing-resistant MFA rather than treating every second factor as equivalent.
As an Amazon Associate I earn from qualifying purchases.
Microsoft reported a 146% rise in adversary-in-the-middle (AiTM) phishing attacks over the prior year in its 2024 Digital Defense Report. That is Microsoft’s reported figure and scope, not a universal independently verified measurement.
For the attack taxonomy and implementation guidance, see CISA’s Implementing Phishing-Resistant MFA fact sheet and Microsoft’s phishing-resistant MFA guidance.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Phishing and adversary-in-the-middle relays
A conventional phishing page can collect a username, password and a six-digit authenticator code. An AiTM relay goes further: it passes the victim’s live authentication through to the real service, then captures the resulting session material. The victim may see a normal sign-in while the attacker receives a valid session.
A code that a person can type into a website is therefore not automatically phishing-resistant. FIDO/WebAuthn authenticators use a cryptographic credential bound to the legitimate site’s origin, making the stolen-code approach much harder. Passkeys are a user-facing form of this approach; FIDO2 security keys are another.
Compatibility and recovery still matter. The identity provider, operating system, browser, account-recovery process and application must support the method. A phishing-resistant primary sign-in can also be undermined by a weaker fallback or account-recovery path, so administrators should review those flows separately.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Push bombing and MFA fatigue
In a push-fatigue attack, the adversary already has a password and repeatedly triggers approval prompts. The user may approve one accidentally, assume the prompts are a system error, or accept simply to stop the interruption.
Number matching is a useful interim defense. Instead of tapping a generic “Approve” button, the user enters a number displayed on the sign-in screen. That makes indiscriminate approvals less effective and raises the cost of repeated prompts. CISA explains the mechanism in its number-matching fact sheet.
Number matching is not a replacement for phishing-resistant MFA. A user can still be deceived during a real-time phishing exchange, and it does not address stolen session tokens. Organizations that cannot deploy FIDO/WebAuthn immediately should enable number matching, set prompt-rate limits where available, train users to deny unexpected requests and investigate repeated failures.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Why SMS and voice MFA remain exposed
Text-message and voice codes are better than no second factor, but the phone network introduces attack paths outside the account itself.
- SIM swapping: Through social engineering or carrier-account compromise, an attacker transfers the victim’s number to an attacker-controlled SIM and receives future codes.
- SS7 exploitation: Weaknesses in the Signalling System 7 telecom infrastructure can allow interception or redirection of SMS and voice traffic.
- Phishing: A code can be captured when a victim enters it into a fake sign-in page or relay.
These are ways an attacker may obtain a code, not proof that every text message will be intercepted. CISA’s overview, More than a Password, explains why method choice matters. Where stronger options are supported, prefer a security key or passkey; otherwise protect the carrier account, use a unique account password and treat unexpected code requests as an incident.
Session-token theft: the attack after MFA
MFA verifies a login; it does not make the resulting session unstealable. Microsoft describes attacks in which an adversary steals a valid sign-in token and replays it to access resources without repeating the original challenge. Malware, browser compromise, malicious extensions, AiTM relays and poorly protected endpoints can all contribute to this stage.
Rank #4
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Microsoft’s identity and secrets guidance and token documentation discuss token protection, which binds tokens to an intended device in supported scenarios. Availability depends on the platform, application and identity configuration; it is not a universal switch.
Defending this stage requires layered controls: managed and patched endpoints, browser and extension controls, short or risk-based session lifetimes, device compliance checks, rapid token revocation and detection of impossible travel or unusual resource access. These measures complement—rather than replace—a strong login factor.
How the main MFA methods compare
| Method | Phishing and AiTM resistance | Telecom exposure | Push-fatigue exposure | Deployment and recovery considerations |
|---|---|---|---|---|
| FIDO2 security key or passkey | Strongest target in CISA guidance; credential is bound to the legitimate site | Not dependent on SMS or voice | Not applicable | Check identity-provider, device, browser and recovery support; maintain a secure backup method |
| Number-matched push | Improves resistance to blind approvals but is not fully phishing-resistant | Usually app-based rather than telecom-code based | Reduces accidental approval | Requires supported authenticator and user training |
| Standard push approval | Vulnerable to real-time deception and approval attacks | Usually not dependent on SMS | High: repeated prompts can cause an accidental approval | Easy to deploy, but monitor prompt abuse |
| Authenticator one-time code | Codes can be relayed through phishing | Less telecom exposure than SMS, but still phishable | Not a push method | Users need a functioning app and a recovery plan |
| SMS or voice code | Phishable and vulnerable to real-time relay | Exposed to SIM swaps and SS7-related interception | Not a push method | Broad compatibility; weakest choice when stronger methods are available |
This is a qualitative comparison, not a universal ranking of every vendor configuration. Recovery procedures, fallback factors and application support can change the outcome.
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
A practical migration plan
- Inventory every factor and fallback. Identify accounts using SMS, voice, generic push, one-time codes, security keys and passkeys. Include help-desk resets and recovery email or phone numbers.
- Prioritize high-impact accounts. Start with administrator, identity-provider, email, password-manager, finance and source-code accounts.
- Deploy phishing-resistant sign-in. Register FIDO2 security keys or passkeys where the provider and applications support them. Verify device, browser and recovery compatibility before enforcing the policy.
- Use number matching during transition. Enable it for push-based authentication when available, and alert on repeated prompts or denied requests.
- Reduce telecom dependence. Remove SMS or voice as the default where a stronger factor works; protect carrier accounts and document emergency recovery.
- Protect active sessions. Apply device compliance, endpoint protection, sensible session policies, token revocation and monitoring for abnormal access. Review whether token-protection features are supported in your environment.
- Test recovery and response. Confirm that a lost key, lost phone, suspected SIM swap or stolen session can be contained without silently downgrading the account to a weaker factor.
What users should do when a prompt or code looks wrong
- Deny an unexpected push; never approve one just to clear the notification.
- Report repeated prompts, a sudden loss of mobile service or an unsolicited carrier change immediately.
- Open the service through a known bookmark rather than a link in an email or message.
- Prefer a passkey or FIDO2 key over SMS when the account offers it.
- If compromise is suspected, change the password from a trusted device, revoke sessions or tokens, contact the carrier about the number and notify the organization’s security team.
What phishing-resistant MFA does—and does not—solve
FIDO/WebAuthn and passkeys directly address the problem of a user typing a reusable code into a fraudulent site. They do not automatically secure a compromised endpoint, eliminate every account-recovery weakness or prevent theft of a session after authentication. The durable strategy is layered: use a phishing-resistant factor for sign-in, harden recovery, secure endpoints and monitor the session that follows.
Frequently Asked Questions
Can hackers get around MFA?
Yes. The outcome depends on the factor and the rest of the account design. Phishing relays, push fatigue, SIM swaps, SS7 abuse and stolen session tokens can bypass or outlast weaker MFA implementations.
What is MFA fatigue?
MFA fatigue, also called push bombing, is the repeated sending of approval prompts to a person who may accept one accidentally or to stop the disruption. Number matching reduces blind approvals but is an interim measure, not phishing-resistant authentication.
Is SMS MFA safe?
SMS is generally safer than having no second factor, but codes can be phished and are exposed to SIM swaps and SS7-related interception. Use a passkey or FIDO2 security key when the service supports it.
What is phishing-resistant MFA?
It is authentication designed so a credential cannot be replayed on a fraudulent site. CISA identifies FIDO/WebAuthn methods as phishing-resistant; actual protection still depends on the identity provider, device, application and recovery configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
