The Four Ways Criminals Beat Multi-Factor Authentication (And What You Can Do About It)
Multi-factor authentication was supposed to be the lock that hackers couldn't pick. It turns out there are at least four reliable routes through it, and most organisations are leaving at least one wide open.
Key points
- 87% of large enterprises use multi-factor authentication regularly, but only around one third of smaller businesses do, according to a JumpCloud 2025 survey.
- Despite 87% of respondents in a Cisco survey calling phishing-resistant MFA critical, fewer than 20% had deployed it across their organisations.
- Criminals broke into Uber in 2022 by bombarding an employee with approval requests until the person gave in and clicked "accept".
- The Colonial Pipeline shutdown in 2021 traced back to a single password on a VPN account with no MFA protection.
- Attackers don't need to crack your password if they can steal the small digital token your browser stores after you've already logged in.
Multi-factor authentication, or MFA, is the extra step that asks you to confirm your identity a second time after entering your password: usually a six-digit code sent to your phone, a prompt in an app, or a fingerprint scan. Security teams have pushed it hard for a decade. Criminals have quietly catalogued every gap in it.
Our earlier piece "What is multi-factor authentication and why does it matter?" established that MFA blocks the vast majority of automated account takeovers even when a password is already stolen. What follows is the other half of that picture.
How do criminals actually get past MFA?
There are four main routes, each exploiting a different weak point in how authentication works in practice.
Fatigue attacks are the bluntest instrument. Criminals trigger dozens of MFA approval requests in rapid succession, usually as pop-up notifications on a victim's phone, until the person taps "approve" just to make it stop. Uber suffered exactly this in 2022. The technique is sometimes called "push bombing" or "prompt bombing", and it works against web apps as readily as mobile ones. Organisations that enforce MFA everywhere actually give attackers more surfaces to try it against.
Social engineering pairs human manipulation with technical tricks. A criminal might call a victim pretending to be IT support (vishing, meaning voice-call phishing) or send a convincing fake text (smishing). The goal is to get the victim to hand over a one-time passcode, visit a fake login page, or approve a request under false pretences. SIM swapping is a related trick: the attacker convinces a mobile carrier's customer service agent to transfer the victim's phone number to a device the attacker controls, redirecting all SMS codes.
Cookie theft targets what happens after a successful login. When you authenticate, your browser stores a small file called a session cookie that proves to websites you've already logged in, so they stop demanding credentials. Criminals who steal that file bypass MFA entirely because the site can't tell whether the person presenting the cookie is the original owner. As KnowBe4's researchers put it, "The authorization process does not have a way of knowing whether the current holder of that access control token was the legitimate user or ever successfully authenticated." Many sites compound the risk by never expiring cookies after a period of inactivity. Our 28 July report showed how this leaves a password reset useless against an attacker already holding a valid session.
Weak-authentication targeting is the simplest approach: find accounts or network entry points that were never enrolled in MFA and attack those instead. Akira ransomware (malicious software that locks an organisation's files and demands payment for the decryption key) broke in through Cisco VPN accounts with no MFA configured. Attackers also hunt for old service accounts belonging to former staff, because those rarely get the same security updates as active ones.
What does the exposure look like across an organisation?
| Attack method | Where it strikes most |
|---|---|
| Push bombing / fatigue | Mobile apps, web portals, any push-notification MFA |
| Phishing relays and fake login pages | Web browsers, email workflows |
| SIM swapping | SMS-based one-time codes |
| Session cookie theft | Browsers, web applications |
| Legacy accounts with no MFA | VPNs, email protocols, service accounts |
Should organisations be worried about AI making this worse?
Yes, and it's already happening. Recent incidents show criminals using AI tools to generate convincing phishing messages at scale and to automate the search for exposed credentials, including cloud access keys and SSH details (SSH is a method for logging into remote computers securely). When attackers can run hundreds of personalised lures simultaneously, even well-trained staff face a harder job spotting the fake.
What should affected users and IT teams actually do?
Switch away from SMS codes wherever possible. SMS has long been considered the weakest MFA channel, and PayPal is eliminating it entirely in 2026. App-based codes or hardware security keys are meaningfully harder to intercept.
Audit every account and application. Forgotten VPN credentials, lapsed email addresses, and dormant service accounts are favourite entry points precisely because nobody's watching them.
Set session time limits. Browsers shouldn't hold valid login cookies indefinitely. Short expiry windows limit how useful a stolen cookie is to anyone who grabs it.
Train staff to recognise fatigue attacks. Employees who understand that a flood of unexpected approval requests is an attack in progress, not a glitch, are far less likely to click "approve" to silence the notifications. Regular drills that simulate exactly this scenario build that instinct before a real attack tests it.
The honest read here: MFA is still worth having. But the gap between having it and having it configured correctly is where most organisations are actually getting hurt.
