Static 2FA assumes the second factor remains under the user’s control and arrives through a trustworthy channel. SIM swap fraud and real-time phishing break both assumptions, because attackers can reroute or relay the code while still presenting a valid login to the system.
Why Static 2FA Breaks Under SIM Swap and Real-Time Phishing
Static 2FA is built on a trust assumption that no longer holds in modern account takeover campaigns: the second factor is treated as a durable control channel rather than a target. With sim swap fraud, the attacker moves the SMS code path to a device they control; with real-time phishing, the attacker relays the one-time code fast enough to satisfy the login flow before the code expires. That means the control can succeed technically while failing operationally.
This is why NHI Management Group treats weak authentication channels as a systemic identity problem, not just a user error problem. The same pattern shows up in compromised workload credentials and OAuth token theft, as seen in CoPhish OAuth Token Theft via Copilot Studio and the broader lessons in 52 NHI Breaches Analysis. Current guidance from CISA cyber threat advisories increasingly stresses phishing-resistant factors because attackers now target the authentication path itself, not just the account password. In practice, many security teams discover this only after a help desk escalation, carrier takeover, or a fully valid login from an attacker-controlled session.
How Defenders Should Rebuild Authentication Around Phishing Resistance
The practical fix is to move from channel-dependent second factors to phishing-resistant authentication that binds the credential to the origin, device, or cryptographic key. FIDO2/WebAuthn passkeys are the clearest example because the private key never leaves the authenticator and the response is tied to the specific relying party. That removes the usefulness of intercepted SMS codes and breaks most relay attacks.
For higher-risk environments, the decision should be based on more than a checkbox MFA policy. Stronger patterns include:
- Replacing SMS and voice OTP with hardware-backed or platform-backed passkeys.
- Using step-up authentication only when the request context justifies it, not for every action.
- Monitoring carrier-change events, password resets, and unusual session reuse as identity risk signals.
- Adding device posture, location, and transaction context before approving sensitive actions.
This matters because authentication is not the same as verification of intent. A relayed OTP proves only that a code was entered in time, not that the legitimate user initiated the session. The same logic appears in NHI governance, where static secret and long-lived credentials fail against rapid abuse; Ultimate Guide to NHIs — Why NHI Security Matters Now frames why brittle identity assumptions collapse under adversarial pressure, and NIST’s NIST SP 800-53 Rev 5 Security and Privacy Controls supports stronger authentication controls and continuous assessment. These controls tend to break down in legacy estates where SMS is still the recovery path, because the recovery flow becomes the easiest route to full account takeover.
Edge Cases Where “Just Use MFA” Still Fails
Tighter authentication often increases user friction and support overhead, requiring organisations to balance phishing resistance against operational reach. There is no universal standard for this yet, especially in mixed environments where some apps support passkeys and others still require OTP fallback.
The biggest edge case is recovery. If an organisation deploys strong MFA but leaves password reset, help desk verification, or account recovery tied to SMS, attackers simply bypass the stronger factor through the weaker path. Another common exception is high-risk users who travel, change devices frequently, or operate in regions with poor authenticator support; for them, security teams need a documented fallback that does not silently reintroduce SMS as the default.
It is also important to distinguish consumer account protection from enterprise session protection. Real-time phishing kits can capture a valid login and reuse the session cookie even when MFA is technically “successful.” Current best practice is evolving toward continuous risk scoring, device-bound credentials, and fewer code-based factors. For broader context on how attackers chain identity weaknesses, Top 10 NHI Issues and the phishing-focused threat patterns in MITRE ATT&CK Enterprise Matrix are useful references. The control fails fastest where recovery, legacy SMS fallback, and session theft overlap in the same authentication stack.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10, OWASP Agentic AI Top 10 and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 | Covers weak authentication and credential capture patterns relevant to OTP abuse. |
| OWASP Agentic AI Top 10 | Useful where phishing-resistant auth protects agents and human operators alike. | |
| CSA MAESTRO | Addresses identity assurance and control-plane trust in modern autonomous systems. | |
| NIST AI RMF | GOVERN | Supports governance of identity risk and human oversight for authentication assurance. |
| NIST Zero Trust (SP 800-207) | SP 800-207 | Phishing-resistant auth fits zero trust by verifying each session and request. |
Define accountable authentication policy, recovery, and monitoring under a formal risk governance program.
