Traditional 2FA/MFA is not enough for passwordless identity

At a glance

What this is: This article compares traditional 2FA/MFA with passwordless authentication and argues that legacy MFA still leaves exploitable trust gaps because it often relies on shared secrets and approval channels.

Why it matters: IAM teams should treat passwordless as a different assurance model, not just a stronger MFA variant, because it changes how access is proven and how attackers can bypass authentication.

Context

Traditional 2FA/MFA is a stronger access check than a password alone, but it still depends on factors that attackers can intercept, coerce, or reuse. In identity governance terms, that means the control often adds friction without fully removing the trust assumptions embedded in the login flow.

Passwordless authentication changes the assurance model by binding authentication to the device and using asymmetric cryptography rather than shared secrets. For workforce and customer access programmes, that shifts the design question from how many factors a user must approve to what the identity system can prove without exposing reusable credentials.

Key questions

Q: What breaks when multi-factor authentication still relies on SMS codes or push approvals?

A: Traditional MFA can fail when attackers intercept one-time codes, trick users into approving prompts, or exploit push fatigue. Those methods improve protection over passwords alone, but they still depend on channels that can be socially engineered or hijacked. Security teams should treat them as weaker than phishing-resistant authentication and limit their use for high-value access.

Q: Why do passwordless methods reduce phishing risk more than traditional MFA?

A: Passwordless reduces phishing risk because it removes the reusable password that attackers most often steal or replay. When implemented with device-bound cryptographic credentials or hardware-backed keys, the credential is harder to capture and reuse remotely. That does not eliminate risk, but it narrows the attack path significantly.

Q: What are the signs that an MFA programme is too easy for attackers to bypass?

A: A weak MFA programme usually depends on reusable codes, SMS, or voice calls, and it may still allow access after phishing attempts or credential theft. If users can be tricked into approving logins through fake prompts or intercepted codes, the control is not doing enough. The practical test is whether the factor resists interception, replay, and social engineering.

Q: Should organisations replace MFA with passwordless authentication?

A: Organisations should not treat this as a simple replacement question. MFA is still useful where passwordless is not yet available, but passwordless raises the security baseline by removing the password as the primary failure point. The right path is to use MFA as a bridge and passwordless as the destination.

Technical breakdown

Why shared secrets weaken 2FA/MFA

Traditional 2FA/MFA often keeps the password as the first factor and adds a second factor such as SMS, OTP, email, or push approval. Those second factors are still vulnerable because SMS can be intercepted through SIM swap abuse, OTPs can be stolen from inboxes, and push prompts can be approved through fatigue or deception. The technical weakness is not just user error. It is that the factor remains reusable or externally reachable, so the authentication event can be manipulated outside the device that initiated it.

Practical implication: treat SMS, OTP, and push-based MFA as weaker assurance steps when designing access for high-risk accounts.

How device-bound passwordless authentication works

Passwordless authentication replaces shared secrets with asymmetric cryptography. A private key stays inside a secure enclave or TPM on the endpoint, and the device signs a challenge that can be verified with the public key. Because the private key never leaves the device and there is no reusable password to steal, credential replay and stuffing are materially reduced. In this model, the endpoint becomes part of the assurance boundary rather than a mere access channel.

Practical implication: align access policy to device-bound credentials and endpoint trust rather than to reusable user secrets.

Why compliance does not equal security assurance

Many compliance regimes ask for strong authentication, but they do not prescribe one exact factor mix. That gap let traditional 2FA/MFA become the default interpretation even when the implementation remained vulnerable to interception and approval fatigue. Passwordless can satisfy strong-authentication expectations while removing the weakest shared-secret elements. For governance teams, the key question is whether the control actually resists modern bypass paths or only satisfies an audit checkbox.

Practical implication: evaluate authentication controls against bypass resistance, not only against compliance language.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Traditional MFA is still a shared-secret control with a veneer of extra assurance. If the first factor is a password and the second factor is a code or approval sent through a reachable channel, the system still depends on secrets that can be intercepted, replayed, or socially engineered. That makes the control easier to bypass than teams often assume, especially for high-value accounts. Practitioners should treat this as a residual trust problem, not as solved authentication.

Passwordless authentication removes the reusable secret that attackers usually target first. By shifting the proving step to device-bound cryptography, the authentication event no longer depends on a code the user can forward, reuse, or approve under pressure. That does not eliminate all identity risk, but it materially changes the attack surface for workforce and customer access. Teams should recognise that the design problem moves from secret protection to endpoint-bound assurance.

Strong authentication should be judged by bypass resistance, not factor count. Two factors can still be weak if both are exposed to the user through recoverable channels such as SMS, email, or push. Governance programmes that equate more prompts with more security miss the underlying issue. Identity teams should reframe assurance around whether the factor can be stolen, replayed, or coerced in real use.

Passwordless creates a more durable access control baseline for NHI-adjacent governance. Even though this article is about human authentication, the lesson maps to broader identity programmes: reusable secrets are the wrong foundation for high-trust access. The more an environment depends on secret reuse, the more review, rotation, and audit become compensating controls instead of primary safeguards. Practitioners should use this as a design signal for authentication architecture across the identity stack.

From our research library:

• eBay's passkey data shows 55-60% of passkey adoption happens on mobile, against around 20% on desktop.

What this signals

Passwordless raises the floor on authentication assurance because it removes the reusable secret from the login flow. That matters for programme design, not just user experience. When a control can no longer be forwarded, replayed, or approved remotely, identity teams have a cleaner basis for policy decisions across workforce and customer access.

Traditional MFA often shifts the problem instead of solving it. The control can reduce casual password abuse, but it still leaves approval channels, recovery paths, and second-device dependence in play. IAM leaders should measure whether their highest-risk journeys still depend on factors that an attacker can coerce or intercept.

Passwordless should be evaluated as an access architecture choice, not a point product feature. Once reusable secrets are removed, recovery, device trust, and session assurance become part of the governance model. That is why the change reaches beyond login convenience into authentication policy, risk tiering, and exception handling.

For practitioners

• Replace SMS and OTP approvals for high-risk access Move privileged and sensitive workforce access away from phone-based second factors that can be intercepted, reused, or fatigue-approved. Prioritise authentication paths that bind the login to the user’s device rather than to a transferable code.
• Adopt device-bound passwordless for critical users Use phishing-resistant authentication that relies on asymmetric cryptography and secure hardware on the endpoint. Focus first on administrators, finance roles, and customer journeys where account takeover has the highest business impact.
• Reassess your strong-authentication policy Check whether your policy equates MFA with actual resistance to interception and push fatigue. Update assurance requirements so the control must withstand real attacker behaviour, not just satisfy an audit label.
• Review recovery and fallback paths Make sure password reset, device replacement, and account recovery do not reintroduce the same weak factors you removed from primary login. Recovery is often the easiest way to bypass a passwordless design.
• Map authentication methods to risk tiers Separate low-risk convenience flows from high-assurance access to sensitive systems. A single authentication pattern across all accounts usually forces the weakest path to become the common standard.

Key takeaways

• Traditional 2FA/MFA can still be bypassed when the second factor is a transferable code or a user-approved prompt.
• Passwordless authentication changes the trust model by binding access to device-held cryptographic proof instead of shared secrets.
• Identity teams should evaluate authentication by bypass resistance and recovery design, not by the number of factors on the login screen.

Key terms

• Passwordless Authentication: An authentication approach that removes passwords and uses a device-bound cryptographic key plus local user verification. It reduces phishing and replay risk, but it only improves assurance when enrollment, recovery, and revocation are tightly governed.
• Second-Factor Authentication: Second-factor authentication adds an additional verification step beyond a primary credential. In mobile identity workflows, it often confirms possession of a phone during a digital transaction, which can reduce spoofing and account takeover risk. The control is strongest when paired with context-aware risk signals rather than used as a standalone gate.
• Shared Secret: Any credential or factor that can be known by more than one party and copied or reused, such as a password, OTP, or recovery code. Shared secrets are fragile because once exposed, they can often be replayed to bypass identity controls.
• Device-bound Credential: A device-bound credential is a key or token that can only be used from an approved device or authenticator. In practice, it reduces replay and theft risk, but it also raises the stakes of enrollment, attestation, and revocation because the credential can act repeatedly until invalidated.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.