Phishing-resistant MFA is now the baseline for identity security

At a glance

What this is: This article argues that “good enough” MFA still leaves human identities exposed because basic methods can be phished, intercepted or bypassed.

Why it matters: IAM teams need to treat phishing-resistant MFA as a baseline control for human access, not an optional upgrade, because weak second factors still collapse under modern attack techniques.

By the numbers:

• 93% of organizations are still using passwords at work or for business.

Context

Phishing-resistant authentication is a control problem, not a feature preference. The article's central claim is that SMS codes, OTPs and push approvals still leave human identity flows exposed to phishing, SIM swapping and man-in-the-middle attacks.

For IAM and identity governance teams, the issue is that a second factor that can be intercepted or socially engineered does not change the underlying trust model. The result is a control that appears stronger than passwords but still fails under current attack methods.

Key questions

Q: What breaks when MFA is present but the login can still be relayed in real time?

A: MFA stops simple credential replay, but it does not stop an attacker who can proxy the live login flow and inherit the resulting session. The broken assumption is that successful authentication proves the right person is in control. In real-time phishing, the identity provider sees a valid user, while the attacker owns the workflow that produced it.

Q: Why do phishing-resistant authenticators lower the risk of adversary-in-the-middle attacks?

A: Phishing-resistant authenticators lower AiTM risk because they cryptographically bind the response to the registered origin. A lookalike domain can capture a password or OTP, but it cannot make a hardware-bound authenticator sign a challenge for a different site. That origin binding blocks credential relay, which is the core mechanism AiTM kits depend on to steal valid sessions.

Q: How should IAM teams prioritise MFA migration?

A: Start with privileged access, remote access and any service that would expose sensitive data or administrative control if compromised. Those paths give the attacker the highest value once basic MFA is bypassed, so they should move first to phishing-resistant methods. Lower-risk user groups can follow once the highest-impact paths are covered.

Q: Should organisations still accept SMS and OTP for business access?

A: They should only do so where the business impact of takeover is low and where stronger options are not yet feasible. For anything that touches admin functions, sensitive data or internal applications, SMS and OTP are too easy to intercept or socially engineer to serve as a durable baseline.

Technical breakdown

Why basic MFA still fails under phishing and MITM

Basic MFA adds a second step, but it often reuses trust channels attackers already know how to intercept. SMS codes can be redirected through SIM swapping, OTPs can be harvested in real time, and push approvals can be socially engineered through fatigue or prompt bombing. A man-in-the-middle kit sits between user and service, relaying credentials and session material fast enough to defeat shared-secret based authentication. The core weakness is that the factor proves only that a code was received, not that the authenticating party is bound to the intended service.

Practical implication: treat any factor that can be relayed or intercepted as insufficient for high-value human access.

What phishing-resistant MFA changes in the authentication model

Phishing-resistant MFA uses cryptographic binding rather than reusable secrets. With FIDO2, WebAuthn, or PKI-based methods, the authenticator proves possession of a private key and ties the authentication to the specific origin or relying party. That makes credential relay far harder because the authentication ceremony is bound to the service being accessed, not just to a one-time code. This is why phishing resistance is materially different from simple multi-factor enrollment: the control changes the way trust is established, not just the number of prompts a user sees.

Practical implication: prioritise origin-bound or certificate-based authentication for access paths where interception risk is unacceptable.

Why implementation complexity is the real adoption blocker

The article points to complexity, cost and operational effort as the main reasons organisations delay adoption. That matters because identity programmes often optimise for rollout speed, not adversary resistance, and basic MFA becomes the compromise that satisfies policy while preserving familiar workflows. But that trade-off is misleading. Once phishing, SIM swapping and MitM are part of the threat model, the organisation is not choosing between perfect and imperfect security; it is choosing between a control that can be relayed and one that is cryptographically bound to the login transaction.

Practical implication: evaluate authentication migration as an identity risk decision, not just a deployment project.

Threat narrative

Attacker objective: The attacker aims to bypass basic MFA and gain trusted access to user accounts and protected internal resources.

1. Entry begins when a threat actor uses phishing or a man-in-the-middle kit against a user protected by basic MFA.
2. Credential access succeeds when the attacker captures or relays the password and one-time factor instead of breaking the account outright.
3. Escalation follows when the attacker reuses the authenticated session to reach internal, 2-factor protected resources.
4. Impact is account compromise and access to systems that the organisation assumed were protected by MFA.

Breaches seen in the wild

• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 150+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing-resistant MFA is now the baseline, not the upgrade path: Basic MFA only shifts the attack from the password to the second factor, and that second factor is often relayable or socially engineerable. Once phishing, SIM swapping and man-in-the-middle interception are in scope, the control is no longer sufficient for high-value human access. Practitioners should stop treating “MFA enabled” as a complete governance answer.

The real failure is trust in interceptable authentication ceremonies: SMS, OTP and push-based flows all assume the user and the service can rely on a shared secret or a user-visible approval step. That assumption breaks when attackers can proxy, replay or nudge the user into approving the wrong transaction. The implication is that identity programmes need to move toward cryptographically bound authentication for exposed access paths.

Good-enough MFA creates compliance theatre: Organisations can satisfy policy language while leaving the actual access path vulnerable to the same attacks that compromise password-only accounts. This is an identity assurance gap, not a user-experience trade-off. The practical conclusion is that governance should measure how resistant an authenticator is to relay and interception, not merely whether a second factor exists.

Identity security is shifting from factor count to factor integrity: The market conversation is moving away from “how many factors” toward “which factors survive current attacker tradecraft.” That aligns with broader zero trust thinking, where the control must remain effective under active adversary pressure. Teams that continue to accept relayed factors as equivalent to phishing-resistant authentication are underestimating their attack surface.

Credential-bound authentication changes the governance unit: In a phishing-resistant model, the important object is not the password or code but the key ceremony and the binding to the relying party. That is a more durable identity trust model for human access, especially in environments with privileged portals, remote work, and externally reachable services. Practitioners should reframe MFA decisions as trust-binding decisions, not checkbox decisions.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Phishing resistance is becoming the operational threshold for identity assurance: Programmes that still count relayable factors as equivalent to strong authentication are preserving a legacy trust model. The practical shift is to rank login methods by whether they survive live interception, not whether they merely add a second step.

Authentication governance now has to treat the factor itself as an adversary-facing control surface. Once attackers can replay or proxy the ceremony, the question is no longer whether MFA exists, but whether it can withstand modern phishing tradecraft.

For practitioners

• Adopt phishing-resistant MFA for privileged and remote access Prioritise FIDO2, WebAuthn or PKI-based authentication for administrator portals, VPN access and other externally reachable human login paths.
• Retire relayable second factors on high-value systems Phase out SMS, OTP and push approval flows where account takeover would expose internal tools, privileged consoles or sensitive customer data.
• Classify authenticator risk by attack resistance Review each authentication method for susceptibility to phishing, SIM swapping, MitM relay and prompt bombing, then rank migration by exposure.
• Measure implementation by access-path exposure Treat externally reachable services, admin functions and business-critical workflows as the first candidates for stronger authentication.
• Reset the MFA baseline in policy Update identity standards so that “MFA enabled” no longer counts as sufficient on its own for high-risk access, and require phishing resistance where the threat model demands it.

Key takeaways

• Basic MFA can still be phished, proxied or manipulated, which leaves human identity flows exposed even when a second factor is present.
• The article cites a survey finding that 93% of organizations still use passwords for business, showing how far many programmes remain from stronger authentication baselines.
• Phishing-resistant MFA shifts the control from shared-secret verification to cryptographic trust binding, which is the more durable answer for high-value access.

Key terms

• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Man-in-the-Middle Attack: A man-in-the-middle attack is an interception technique where an attacker positions themselves between two parties that believe they are communicating directly. The attacker can read, alter, or replay traffic, which makes the attack especially dangerous when credentials, sessions, or certificates are involved.
• Origin binding: A cryptographic property that ties an authentication response to the legitimate site or service being accessed. It reduces the value of fake login pages because a credential response generated for one origin cannot be reused on another without failing verification.
• Prompt Bombing: An attacker technique that floods a user with repeated MFA requests until one is approved out of confusion, fatigue, or annoyance. It works because the control depends on a human making a quick decision under pressure, rather than on a factor that cannot be socially engineered.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.