Why do code-based MFA methods remain risky for high-risk accounts?

Code-based methods can be relayed, phished, or manipulated through recovery processes, which means they improve security without eliminating the attacker’s opportunity. For administrators, the remaining exposure is too large because a successful phishing attempt can still lead to account takeover and privileged misuse.

Why This Matters for Security Teams

Code-based MFA is better than passwords alone, but it does not reliably stop takeover of high-risk accounts because the attacker only needs to intercept, relay, or force a recovery path once. That matters most for administrators, finance approvers, and cloud operators, where a single compromised session can expose secrets, reset controls, or alter security settings. NHIMG’s research on NHI abuse shows how quickly exposed credentials are targeted in the wild, which is the same operational reality security teams face when authentication still has reusable attack paths, as highlighted in Top 10 NHI Issues and NIST Cybersecurity Framework 2.0.

The core problem is not that codes are useless. The problem is that they are often treated as a sufficient second factor for accounts that can change identities, privileges, or recovery settings faster than a human can intervene. For those accounts, the residual risk remains high even when MFA is present, because the attacker’s goal is usually persistence and privilege misuse, not just login success. In practice, many security teams encounter account takeover only after the attacker has already abused a recovery flow or a helpdesk exception.

How It Works in Practice

Code-based MFA typically relies on a one-time code delivered by SMS, email, authenticator app, or backup token. In low-risk consumer scenarios, that may be adequate. For high-risk accounts, the issue is that codes are still phishable, relayable, and vulnerable to session hijacking. An attacker can capture the code in real time, then use it immediately before the legitimate user notices. That makes the control time-bound, not attack-proof.

Security teams should think in terms of residual attack paths. Code-based MFA does not eliminate:

• Real-time phishing proxies that relay the login and code at the moment of use
• Recovery workflows that can be manipulated through social engineering or mailbox compromise
• Token theft after MFA, where the attacker reuses the authenticated session
• Privilege changes made after login, especially on administrator accounts

For high-risk access, stronger options are moving toward phishing-resistant methods such as hardware-backed authenticators and device-bound assertions, aligned with the control intent in NIST SP 800-53 Rev 5 Security and Privacy Controls. NHIMG’s guidance in Ultimate Guide to NHIs — Why NHI Security Matters Now reinforces the same operational pattern: once credentials or authentication artifacts become replayable, the attacker’s job becomes much easier.

Where this guidance breaks down is in environments that still depend on shared admin mailboxes, legacy VPNs, or helpdesk-driven recovery, because those processes often become the attacker’s easiest bypass.

Common Variations and Edge Cases

Tighter authentication often increases user friction and support overhead, so organisations must balance usability against the much higher blast radius of privileged accounts. Current guidance suggests treating all code-based MFA as risk-reducing, not risk-eliminating, and applying it selectively rather than universally. The strongest candidates for upgraded controls are domain admins, cloud administrators, break-glass accounts, payment approvers, and accounts that can modify identity systems.

There is no universal standard for this yet, but best practice is evolving toward layered protections: phishing-resistant MFA, conditional access, device posture checks, restricted recovery channels, and strong logging around resets and enrollment changes. For high-risk accounts, recovery is often the weakest link, so a secure login method can still fail if a helpdesk can be convinced to reset credentials or bypass enrollment.

NHIMG’s OWASP NHI Top 10 and the 2024 ESG Report: Managing Non-Human Identities both reflect the same operational lesson: when identity controls are easy to replay, compromise becomes a matter of timing rather than sophistication. For high-risk accounts, code-based MFA should be viewed as a baseline control, not the final control.

Related resources from NHI Mgmt Group

• Why do passwords and SMS-based MFA remain high-risk in banking?
• Why do non-human identities create more audit risk than human accounts?
• Why do leaked secrets remain such a persistent NHI risk?
• When should organisations treat an NHI as a high-priority risk?