The Four Ways Criminals Beat Multi-Factor Authentication (And What You Can Do About It)
Multi-factor authentication was supposed to be the lock that hackers couldn't pick. It turns out there are at least four reliable ways through it, and most organisations are leaving at least one door wide open.
Key points
- 87% of large enterprises use multi-factor authentication regularly, but only around one third of smaller businesses do the same, according to a JumpCloud 2025 survey.
- Despite 87% of respondents in a Cisco survey calling phishing-resistant MFA critical, fewer than 20% had actually deployed it across their organisations.
- Criminals broke into Uber in 2022 by bombarding an employee with approval requests until the person gave in and clicked "accept".
- The 2021 Colonial Pipeline shutdown traced back to a single password on an old VPN account that had no MFA protection at all.
- Attackers do not need to crack your password if they can steal the small digital token your browser stores after you have already logged in.
Multi-factor authentication, or MFA, is the extra step that asks you to confirm your identity a second time after entering your password: usually a six-digit code sent to your phone, a prompt in an app, or a fingerprint scan. Security teams have pushed it hard for a decade. Criminals have quietly been cataloguing every gap in it.
A detailed survey of MFA attack methods, originally published by CSO Online, maps out just how many gaps exist. The picture is not reassuring.
How do criminals actually get past MFA?
There are four main routes, and each one exploits a different weak point in how authentication works in the real world.
Fatigue attacks are the bluntest instrument. Criminals trigger dozens of MFA approval requests in rapid succession, usually as pop-up notifications on a victim's phone, until the person taps "approve" just to make it stop. Uber suffered exactly this in 2022. The technique is sometimes called "push bombing" or "prompt bombing", and it works equally well against web apps as against mobile ones. Ironically, organisations that enforce MFA on everything give attackers more opportunities to try it.
Social engineering pairs human manipulation with technical tricks. A criminal might call a victim pretending to be IT support (vishing, meaning voice-call phishing) or send a convincing fake text message (smishing). The goal is to get the victim to hand over a one-time passcode, visit a fake login page, or approve a request under false pretences. SIM swapping is a related trick: the attacker convinces a mobile carrier's customer service agent to transfer the victim's phone number to a device the attacker controls, redirecting all SMS codes.
Cookie theft targets what happens after a successful login. When you authenticate, your browser stores a small file called a session cookie. That cookie proves to websites that you already logged in, so they stop asking for credentials. Criminals who steal that file bypass MFA entirely because the website cannot tell whether the person presenting the cookie is the original owner. Many websites make this worse by never expiring cookies after a period of inactivity.
Weak-authentication targeting is the simplest approach of all: find the accounts, apps, or network entry points that were never enrolled in MFA and attack those instead. Akira ransomware (malicious software that encrypts an organisation's files and demands payment to unlock them) broke into organisations through Cisco VPN accounts, meaning company remote-access systems, that had no MFA configured. Attackers also hunt for old service accounts belonging to staff who have left, because those accounts rarely get the same security updates as active ones.
What does the exposure look like across an organisation?
| Attack method | Where it strikes most |
|---|---|
| Push bombing / fatigue | Mobile apps, web portals, any push-notification MFA |
| Phishing relays and fake login pages | Web browsers, email workflows |
| SIM swapping | SMS-based one-time codes |
| Session cookie theft | Browsers, web applications |
| Legacy accounts with no MFA | VPNs, email protocols, service accounts |
Should organisations be worried about AI making this worse?
Yes, and it is already happening. Recent incidents show criminals using AI tools to generate convincing phishing messages at scale and to automate the search for exposed login credentials, including cloud access keys and SSH details (SSH is a method for logging into remote computers securely). When attackers can run hundreds of personalised lures simultaneously, even well-trained staff face a harder job spotting the fake.
What should affected users and IT teams actually do?
Switch away from SMS codes wherever possible. SMS has long been considered the weakest form of MFA and PayPal is eliminating it entirely in 2026. App-based codes or hardware security keys are meaningfully harder to intercept.
Audit every account and application in the organisation. Legacy VPN accounts, old email addresses, and forgotten service accounts are favourite entry points precisely because nobody is watching them.
Set session time limits. Browsers should not hold valid login cookies indefinitely. Short expiry windows limit how useful a stolen cookie is.
Train staff to recognise fatigue attacks. Employees who understand that a flood of unexpected approval requests is an attack in progress, not a glitch, are far less likely to click "approve" to make the notifications stop. Regular drills that simulate exactly this scenario build that instinct before a real attack tests it.
