Multi-factor authentication: which second factor is actually secure?

Multi-factor authentication (MFA) means asking for at least one more proof beyond your password when you sign in: a code sent to your phone, a tap in an app, or a security key. The figure Microsoft has repeated for years is blunt: MFA stops more than 99% of automated account-takeover attacks. But here is the part that matters most: not all MFA is equal. From weakest to strongest, the order runs like this: SMS and voice codes, app-based codes (TOTP), push approvals, and phishing-resistant methods (FIDO2/passkeys and hardware keys). The short answer is to turn MFA on everywhere, but move your valuable accounts to a phishing-resistant method. SMS is the weakest link, and regulators are retiring it.

Why a password alone is not enough

Attackers usually do not crack your password, they buy it. Billions of leaked credentials circulate on criminal markets, and a verified username-and-password pair for a corporate account often sells for 10 to 50 dollars. In an attack called credential stuffing, bots replay those lists against thousands of sites automatically, and if you reused a password anywhere, one of those doors opens. Microsoft reports observing hundreds of millions of identity attacks every day, the overwhelming majority of them password-based. This is exactly where MFA earns its place: even if the password leaks, the login fails without the second proof. We covered the phishing that kicks off most of these attacks in a separate post.

SMS and voice codes: the weakest link

The most common form of MFA is also the most fragile. It has two well-known weaknesses. The first is SIM swapping: an attacker talks your mobile carrier into moving your number to a SIM in their possession, and from that moment every code meant for you arrives on their phone instead. The second is SS7, the ageing protocol underneath the phone network, which has had documented interception flaws since 2014. SMS was never built for security in the first place; messages travel across the carrier network unencrypted. That is why the US standards body NIST, in its 2024 revision of SP 800-63B, moved SMS codes into a "restricted" category and advised organizations at higher assurance levels to phase them out. SMS-based MFA beats no MFA at all, but it is the last method you should lean on.

App codes (TOTP) are better, but still phishable

The six-digit codes that rotate every 30 seconds in Google Authenticator, Microsoft Authenticator and similar apps (TOTP) are clearly safer than SMS. SIM swapping and network interception cannot reach them, because the code is generated locally on the phone. One gap remains, though: real-time phishing. The attacker stands up a fake page that looks like your bank, you type your password and the code into it, and a relay behind the scenes (an adversary-in-the-middle) forwards both to the real site instantly and hijacks the session. Every code you type is a secret that can be handed to someone else. TOTP is a solid middle rung, but it is not the top of the ladder.

Push approvals and the fatigue trap

The method that drops a "Do you want to sign in? Approve / Deny" prompt onto your phone is very convenient, which is precisely why it gets abused. If the attacker already holds your password, they send dozens of approval prompts back to back to wear you down (MFA bombing, or push fatigue). The goal is that in a moment of distraction, or thinking "this must be a glitch," you tap Approve. The September 2022 Uber breach is the textbook case: the Lapsus$ group had a contractor's password, flooded them with prompts for hours, then messaged over WhatsApp claiming to be the IT team and asked them to approve. The contractor did, and the internal network was open. MITRE ATT&CK tracks this as its own attack technique. The good news is that number matching largely shuts it down: instead of a blind "approve," you have to type a two-digit number shown on your login screen into the app. Microsoft made this mandatory across all accounts in May 2023.

Phishing-resistant MFA: FIDO2 and hardware keys

The strongest layer is the one designed so it cannot be phished: passkeys built on FIDO2/WebAuthn, and physical security keys such as a YubiKey. What sets them apart is that authentication is done with a cryptographic key that knows exactly which domain it belongs to. A key created for yourbank.com simply will not work on a look-alike page like yourbank-security.com, and there is no code for you to type and hand over in the first place. Neither real-time phishing nor MFA bombing works against this method. It maps directly onto the "verify every access" principle of a zero trust model. The US cyber agency CISA, in its "phishing-resistant MFA" guidance, names FIDO2/WebAuthn and smart cards (PKI) as the gold standard, and in July 2025 urged organizations to move to it for email, VPNs and critical systems. We explained how passkeys work and where to start in your company in a dedicated post.

Which method for which account

The practical order is clear. For accounts with no MFA at all, the first step is to switch on any second factor, since even SMS closes an open door. The next step is to move from SMS to app-based codes or number-matched approvals wherever you can. For your most valuable accounts, meaning administrator access, email, finance and VPN, a phishing-resistant method is essential: use a hardware security key or a passkey for those roles. The rule is simple: as an account's value goes up, so should the resistance of its MFA to phishing.

The most common mistakes

A few traps quietly undo an otherwise good MFA setup. The most frequent is turning on the strong method while leaving the old weak one enabled "just in case" as a fallback. Attackers always probe the weakest door; if you add a passkey but leave SMS switched on beside it, you hand back what you gained. The second is enabling MFA on only some apps while leaving critical logins like email or VPN outside its scope. The third is having no recovery plan: how does a user who loses every device get back into the account? If you do not write that path down in advance, remember that an attacker will try the same recovery route.

Turning on MFA is not a checkbox but a graded decision: matching the right strength to each account. At Wedevit we map your MFA posture on the identity platform you already run (Microsoft 365 / Entra ID or Google Workspace), reduce your reliance on SMS, and plan the move to phishing-resistant methods for administrator and finance roles. The concrete first step is to list which of your accounts today have no MFA or depend on SMS alone, because until you can see the first gap, you cannot know where to close it.