Why do SMS and push-based one-time passwords increase risk during phishing campaigns against identity providers?

SMS and push one-time passwords are vulnerable because attackers can trick users into revealing or approving them in real time. When the phish mimics a legitimate login page, the secret and the second factor can be captured together, defeating the intended protection. FIDO2 compliant security keys reduce this risk by binding authentication to a trusted device and resisting replay.

Why SMS and Push Codes Are Weak Against Real-Time Phishing

SMS and push-based one-time passwords are effective only when the second factor is validated in a trustworthy context. During phishing campaigns aimed at identity providers, that assumption breaks down because the attacker controls the conversation in real time. The user is not simply “stolen” a code; they are often induced to enter it into a fake sign-in flow or approve a request that the attacker immediately relays to the real service. That turns a supposed possession check into a live relay path, which is why these methods are materially weaker than phishing-resistant authenticators.

Identity teams often underestimate the problem because the authentication event still “succeeds” in logs, even though the user’s intent and the relying party’s trust boundary have already been compromised. In practice, many security teams encounter the weakness only after a convincing phish has already converted a valid second factor into attacker-controlled access.

With SMS-based one-time passwords, the attacker only needs the victim to disclose a short-lived code before it expires. With push-based authentication, the attacker often sends repeated prompts or uses social engineering to make the user approve a request they do not fully understand. In both cases, the phishing page captures the primary credentials and the second factor close together, which removes the normal separation between “something you know” and “something you have.”

For identity providers, the key failure is that the authenticator does not strongly bind the user’s action to the legitimate origin, session, or transaction. A phish can therefore proxy the authentication ceremony and reuse the result immediately. This is why phishing-resistant methods such as FIDO2 security keys are different in kind: they verify the origin and bind the proof of possession to the real service, which makes simple replay or relay attacks far harder.

SMS codes can be intercepted through user disclosure, message forwarding, or mobile-channel abuse.
Push approvals can be abused through fatigue, confusion, or prompt bombing.
Relay attacks succeed when the factor is accepted without a strong origin binding.
Step-up authentication helps only if the step-up method itself resists phishing.

The practical boundary is simple: if a factor can be handed to a phish in real time and accepted by the legitimate IdP, it is a weak defence against credential harvesting and session hijacking.

Where the Risk Is Highest and What Security Teams Should Watch For

Tighter authentication often increases friction, so organisations must balance user convenience against the assurance they actually get from the factor. SMS and push both create exposure when the identity flow is high-value, externally reachable, or frequently targeted by social engineering. The risk is highest where a successful login grants access to email, SSO, admin consoles, or downstream systems that inherit trust from the identity provider.

For readers tracking implementation guidance, the broader governance lesson aligns with the NIST Cybersecurity Framework 2.0 emphasis on strengthening access control, resilience, and recovery around critical trust paths. Industry consensus is clear that phishing-resistant authentication is preferable for privileged and high-risk access, while SMS and push should be treated as lower-assurance options rather than strong protection.

Security teams should watch for sign-in events that appear valid but are followed by unusual token use, mailbox rules, consent grants, or session creation from new geographies. Those are often the downstream indicators that the second factor did not fail technically, but failed operationally as a trust control.

Risk and Threat Considerations

SMS and push-based one-time passwords increase exposure because they are replayable in a live phishing workflow and depend heavily on user recognition and judgment. That creates a material account takeover risk even when the organisation believes it has enabled multifactor authentication.

Failure mechanism: The attacker captures the password and the second factor in the same interaction, or induces approval of a push prompt, then replays the authentication result against the real identity provider before the code expires or the session context changes.

Impact: The attacker can establish an authenticated session, bypass weak second-factor assurance, and use that foothold to access email, SSO, sensitive applications, or privileged workflows that trust the identity provider.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0, CIS Controls v8 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
NIST CSF 2.0	PR.AA — Identity Management, Authentication, and Access Control	The question concerns assurance limits in authentication during phishing.
Recommendation — Strengthen authentication assurance and restrict weaker factors for high-risk access.
CIS Controls v8	6 — Access Control Management	This is about controlling access methods and reducing takeover exposure.
Recommendation — Enforce stronger authentication for sensitive accounts and remove weak fallback paths.
MITRE ATT&CK	T1111 — Multi-Factor Authentication Interception	The attack uses live relay or interception of the second factor.
Recommendation — Detect and disrupt MFA interception and relay activity in your phishing detections.
NIST SP 800-63	5 — Digital Identity Guidelines: Authenticator and Lifecycle Management	Authenticator strength and phishing resistance are central to the issue.
Recommendation — Use phishing-resistant authenticators for transactions that need higher assurance.

Practitioner Guidance

What to prioritise: Treat phishing-resistant authentication as the default for administrators, remote access, and any user population that can reach high-value applications through the identity provider. Reserve SMS and push for lower-risk scenarios only when there is a clear interim justification.

What to verify: Confirm that your stronger factor actually binds to the legitimate origin and cannot be satisfied by a simple relay. Also verify that sign-in logs, conditional access policies, and help desk recovery paths do not quietly reintroduce weaker authentication for the same accounts.

Common mistake: Assuming that any second factor meaningfully stops phishing. A factor that can be entered into a fake page or approved under pressure may improve baseline security, but it does not reliably prevent real-time identity-provider phishing.

Practitioner takeaway: The decisive question is not whether multifactor authentication is enabled, but whether the second factor resists live interception by an attacker controlling the login conversation.