Context-aware MFA is replacing static 2FA in Kenyan enterprises

At a glance

What this is: This is an analysis of why Kenyan enterprises are replacing static 2FA with context-aware MFA, driven by SIM swap fraud, phishing kits, and credential stuffing.

Why it matters: It matters because IAM teams must align authentication strength with real-time risk, especially where human access is exposed to mobile fraud, remote work, and regulatory scrutiny.

By the numbers:

• In 2022, the Communications Authority of Kenya recorded over 370,000 mobile-related cybercrime reports, many involving SMS interception.

Context

Kenyan enterprises are dealing with a growing authentication gap. Static 2FA assumes a second factor remains trustworthy after enrollment, but SIM swap fraud, real-time phishing relays, and credential stuffing all undermine that assumption once attackers can intercept or reuse the factor.

In practice, the issue is not whether a second factor exists but whether it still reflects the current login context. As more organisations support mobile banking, remote work, BYOD, and cloud access, authentication has to adapt to device posture, location, time, and user behaviour rather than rely on a fixed challenge.

That makes this primarily a human IAM and fraud-control problem, with direct implications for customer access, workforce access, and regulated digital services.

Key questions

Q: Why do SMS-based one-time passwords create such a weak defence against modern account takeover attacks?

A: SMS OTP is vulnerable because the code travels through channels attackers can intercept through phishing, malware, SIM swapping, or social engineering of telecom staff. Once the code is captured, the second factor no longer adds meaningful protection. The weakness is not the idea of a second factor, but the delivery method and its dependence on a compromised phone number.

Q: When should organisations move from static 2FA to context-aware MFA?

A: They should move when access risk changes by device, location, user behaviour, or fraud pressure, because a fixed second factor cannot adapt to those conditions. If the same login pattern can produce very different risk levels, the control should step up or block based on context rather than stay static.

Q: What are the signs that account sign-in controls are not keeping up with fraud?

A: Look for repeated login bursts, device or IP reuse across many accounts, unusual proxy indicators, rising first-session abuse, and a mismatch between authentication success and downstream loss. Those signals show that the entry point is absorbing attack volume instead of filtering it.

Q: How should teams govern biometric and push-based MFA without creating new weak points?

A: They should govern enrollment, device binding, and recovery as part of the same authentication policy. Biometrics and push approval reduce relay risk, but weak reset processes or unmanaged enrollment can reintroduce the very bypasses stronger factors were meant to close.

Technical breakdown

Why static 2FA fails under SIM swap and OTP interception

Static 2FA works when the second factor remains bound to the legitimate user, but SMS-based OTPs are vulnerable once a phone number is hijacked or the code is relayed in real time. SIM swap attacks and phishing-as-a-service kits break the assumption that possession of a device equals possession of the account. In risk terms, the authenticator is no longer the user, it is the attacker-controlled relay. That is why SMS OTP is a weak control in environments where telco compromise, social engineering, or session interception are realistic threats.

Practical implication: Treat SMS OTP as a fallback, not a primary control, where account takeover would create financial or regulatory exposure.

How context-aware MFA changes the authentication decision

Context-aware MFA adds risk signals such as device fingerprinting, attestation, location, time, and behavioural baselines to decide whether to step up, step down, or block access. The important shift is that authentication becomes conditional rather than fixed. Instead of asking only whether the user has a factor, the control asks whether this login looks like the user’s normal pattern and whether the endpoint can be trusted. This is especially relevant for enterprises running remote access, mobile apps, and cloud-connected workflows across mixed trust environments.

Practical implication: Use risk-based policies to trigger stronger checks when device or location signals deviate from the user baseline.

Why biometric and push-based factors reduce OTP fragility

Biometric authentication and mobile push approval can reduce exposure to OTP replay and relay attacks, but only when they are implemented with sound cryptographic and lifecycle controls. Biometrics help strengthen the possession-plus-inherence model, while push approval reduces code interception risk. Neither control is automatically safe if account recovery is weak, device enrolment is lax, or approval prompts can be socially engineered. The technical issue is not just the factor type, but whether enrollment, recovery, and device trust are governed as part of one authentication system.

Practical implication: Govern factor enrollment and recovery with the same rigor as sign-in, or stronger factors will inherit weak processes.

Threat narrative

Attacker objective: The attacker aims to bypass human authentication controls and gain account access for fraud, account takeover, or unauthorised transactions.

1. Entry begins when attackers obtain a user’s mobile number or login path through SIM swap fraud, phishing, or credential stuffing.
2. Credential capture or relay occurs when the attacker intercepts SMS OTPs or relays them through a real-time phishing kit.
3. Impact follows when the attacker uses the compromised authentication path to take over accounts, access mobile banking, or abuse digital services.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Static second factors are no longer a stable security boundary: SMS OTP assumes the enrolled factor continues to belong to the legitimate user throughout the session. That assumption fails when telcos can be manipulated, phishing kits can relay codes, and users authenticate from unmanaged endpoints. The implication is that authentication governance has to move from factor presence to factor trustworthiness at the moment of login.

Context-aware MFA is really risk-adaptive identity assurance: The material change is not the extra factor itself but the decision logic around it. Device posture, location, timing, and behavioural baselines make authentication responsive to fraud conditions instead of mechanically repeating the same challenge. For identity programmes, that is a shift from static assurance to conditional assurance.

Kenyan digital growth exposes the limits of one-size-fits-all authentication: Remote work, BYOD, mobile finance, and cloud access widen the number of contexts in which identity is used. When the same authentication method is forced across all of them, user friction rises while security remains uneven. The governance task is to align assurance strength with the actual access scenario, not with a generic policy baseline.

Account recovery is part of authentication governance, not a side process: Biometric or push-based MFA does not close risk if recovery workflows still allow weak re-enrolment or factor reset paths. The control surface now includes how users regain access after device loss, number change, or enrolment failure. Practitioners should treat recovery as part of the authentication trust chain, not as an administrative exception.

Named concept: authentication context drift: The login context that existed at enrollment is not the same as the context at use. That drift matters because static 2FA was designed for stable assumptions about identity possession, while modern fraud turns those assumptions into moving targets. Teams need to govern the context in which authentication occurs, not just the factor that is presented.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Authentication context drift: Static 2FA fails when the trust conditions at enrollment no longer match the conditions at login. That gap is now common in mobile-heavy environments, where number portability, unmanaged devices, and real-time phishing all change the assurance level after the factor is issued.

Mature identity programmes will increasingly judge authentication by the quality of the login context, not by whether a code or push prompt was used. That is a governance shift, not just a technology upgrade, because it changes how teams assess trust, exceptions, and recovery paths.

For practitioners

• Replace SMS OTP with risk-based MFA policies Prioritise risk-based policies for banking, customer portals, and remote workforce access where SIM swap and phishing are credible threats. Keep SMS OTP only as a limited fallback for low-risk scenarios.
• Bind authentication to trusted devices Use device fingerprinting and attestation so login decisions can distinguish enrolled devices from anomalous or unmanaged endpoints. This matters most when BYOD and mobile access are part of the operating model.
• Tighten account recovery and factor reset flows Review recovery steps, number-change handling, and help-desk overrides so they do not become the easiest path around stronger MFA. Recovery should be treated as part of the authentication control set.
• Add behavioural and location signals to step-up rules Trigger additional verification when location, time, or login pattern deviates from the user baseline, especially for financial transactions and administrative access.

Key takeaways

• Static 2FA is increasingly outmatched by SIM swap fraud, phishing relays, and credential stuffing in mobile-first environments.
• Context-aware MFA raises assurance by tying authentication decisions to device, location, and behavioural signals instead of a fixed challenge.
• Recovery and factor reset processes must be governed as part of the authentication control set, or stronger MFA will inherit weak bypass paths.

Key terms

• Context-Aware MFA: Context-aware MFA is authentication that changes its challenge level based on risk signals such as device health, location, behaviour, and access history. It is not just more factors. It is a policy-driven trust decision that adapts to the conditions of the login.
• SIM-Swap Fraud: SIM-swap fraud happens when an attacker takes control of a victim’s mobile number by moving it to a different SIM card. That takeover can bypass phone-based verification and redirect alerts, one-time codes, and account recovery flows. In financial services, it often enables account compromise and unauthorized transfers.
• Risk-Based Authentication: An access model that changes verification requirements based on the estimated risk of the request. It combines identity assurance, device posture, application sensitivity, and contextual signals to decide whether to allow, block, or step up verification before access is granted.
• Credential Context Drift: Credential context drift happens when a secret leaves its intended system and starts appearing in places with different access rules, retention periods, and sharing behaviours. The control gap is not just exposure, but the loss of the original governance boundary around the credential.

Deepen your knowledge

NHI governance, human identity, and secrets management are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.