Multi-factor authentication (MFA) is the mechanism that requires two or more different proofs before letting someone into a system. The idea is old and simple: a single proof can be stolen, while two proofs of a different nature are much harder to obtain. The three classic families are something you know (a password), something you have (a phone, a physical key) and something you are (a fingerprint, your face).
For almost a decade, turning on MFA was the advice that delivered the most for the least cost. It still is. What changed is that it stopped being enough, and it is worth understanding exactly why, because the answer is not to turn it off.
Why did a second factor change things so much?
Because it broke the business model of password theft. With a stray credential, an attacker could get in. With a second factor, that credential alone stopped being enough, and a leaked database with a hundred thousand passwords became much less profitable to exploit.
That is why financial regulation, cyber insurance and practically every audit now treat it as mandatory. And it worked: mass credential theft stopped being the dominant way in.
The problem is that the attacker did not give up. They changed targets.
What types of second factor exist, and which ones really hold up?
Not all second factors protect equally. The difference between the weakest and the strongest in this table is enormous, and in many companies both coexist without anyone having decided it.
| Type | How it works | How well it holds up |
| SMS code | A number arrives on the phone | The weakest. It can be intercepted, and the phone number can be hijacked |
| Push notification approval | A mobile alert with an accept button | Weak. It depends on the person saying no when they are tired |
| App-based code | A number that changes every thirty seconds | Medium. It can no longer be intercepted, but the victim can be asked to read it out |
| Number matching | The screen shows a number that must be typed on the phone | Medium-high. Stops reflexive approval cold |
| Physical key or device biometrics (FIDO2) | The device signs cryptographically and checks which site it is connecting to | The strongest. Phishing-resistant because it cannot be used on a fake site |
The fundamental difference is in the last row. The first four depend on a person doing one thing right at the right moment. The last one depends on no one: the device itself checks which address it is connecting to and refuses if it is not the legitimate one. That is why CISA calls it phishing-resistant MFA and isolates it from the rest.
How is MFA broken without knowing the password?
There are three paths that work today and that do not require guessing anything.
Fatigue. The attacker already has the password, taken from a leak or a fraudulent email, and launches a series of login attempts. The victim starts receiving notifications on their phone. One, five, twenty. At three in the morning, someone exhausted taps accept to make it stop. It takes no ingenuity, only persistence.
Number hijacking. With enough personal data, the attacker convinces the phone carrier to move the number to another SIM card. From then on, SMS codes go to the attacker. That is why NIST's digital identity guidelines have discouraged SMS as a second factor for years.
The intermediary. The quietest of the three. The victim receives a link and lands on a page identical to the real one. That page does not store the password: it forwards it to the genuine site in real time, asks for the second factor, forwards that too, and lets the victim through as normal. The login was legitimate. It just happened through someone else.
Has this already happened to someone big?
Yes, and rather humiliatingly. In September 2022, the Lapsus$ group got into Uber using exactly the first method on the list. They obtained a contractor's password, sent a series of login notifications for more than an hour and, when the person no longer knew what was going on, contacted them via messaging posing as the company's own IT team to tell them to accept so the notifications would stop.
They accepted. And it was not a slip by someone poorly trained: it was a contractor at a technology company with a security program well above average.
That same group repeated the pattern with other large companies in the following months. The lesson is not that people fail, because people always end up failing when subjected to enough pressure. The lesson is that a control that depends on a tired person making the right decision the first time is not a strong control.
What is session theft, and why does it sideline authentication?
Here is the point that is almost never explained and that changes the entire approach.
When you log in to a system, it does not ask you for your password on every click. It gives you a temporary credential, a session token, which your browser stores and presents with every subsequent request. That is what saves you from having to authenticate forty times a day.
That token is what the intermediary in the previous section steals. It is also stolen by certain malware that searches the browser directly, without going through any fake page.
With the token in hand, the attacker no longer authenticates. They reuse something that is already authenticated. For the system, there is no suspicious login to block, because there is no login at all: there is a valid session that continues. Authentication, however good it is, has no say in what happens afterward.
And this is the sentence that sums up the whole problem: MFA protects the door, not the house.
So should it be removed?
No. Removing it would mean going back to a world where a leaked password is enough to get in, which is infinitely worse.
What needs to happen is to stop treating it as the end of the road. For years, the idea took hold that turning on MFA was the point where access security was solved. Today it is the point where it begins.
What does regulation in Mexico require?
The CNBV regulations for credit institutions and financial technology institutions require strong authentication, and Banco de México (Mexico's central bank) Circular 8/2019 applies equivalent requirements to SPEI participants, along with encryption, real-time monitoring and fraud prevention.
It is worth reading carefully how the requirement is worded, because almost no regulation says “turn on MFA and you're done.” What they ask for is strong authentication and continuous monitoring, both, in the same paragraph. A company can have the second factor turned on and still not be compliant if nobody is watching what happens after login.
How do you modernize without redoing everything?
In four phases, and none of them requires throwing out the current infrastructure.
- First, turn off what no longer holds up. Remove SMS as a second factor and replace one-button approval with number matching. These are configuration changes, not projects, and they eliminate the two most common attacks in one stroke.
- Second, phishing-resistant keys where it hurts most. You do not need to roll them out across the whole company on day one. Start with administrator, finance and executive accounts, which are the ones an attacker goes after first.
- Third, verify the device, not just the person. Require that access also come from a device that is known, up to date and has active protection. A stolen token presented from an unknown device should fail on that second condition, even if the token is valid. This is the principle of Zero Trust applied to everyday access.
- Fourth, monitor the session, not just the login. Because if the token is used from another country, at another time and at a pace no person could sustain, that can be seen. But someone has to be watching.
That fourth phase is the one almost nobody does, and it is the only one that covers the gap the other three leave. A monitoring center does not prevent a token from being stolen. What it does is notice that the session is behaving in a way it should not, and cut it off before the attacker gets where they were going.
Frequently asked questions
Is MFA the same as two-step verification?
Does a password manager replace MFA?
Are FIDO2 keys expensive to deploy?
How do I know whether my company still uses SMS as a second factor?
Does MFA help at all against an employee acting in bad faith?
A good door on an unguarded house
MFA did its job and still does. It turned password theft into a bad business and forced attackers to work much harder. Nothing written here is an argument for turning it off.
What no longer holds up is the idea that this is enough. An excellent lock on the front door says nothing about what happens inside the house once someone manages to get through. And today's attacker is not forcing the door: they are walking in with a key that someone who did have permission lent them without knowing it.
