Topic starter
11/07/2026 1:54 pm
TL;DR: Kenyan enterprises are moving from static 2FA to context-aware MFA as SIM swap fraud, real-time phishing kits, and credential stuffing make SMS OTP controls increasingly fragile, according to eMudhra. The shift matters because identity assurance now has to adapt to device posture, location, and login risk rather than rely on a single second factor.
Editorial analysis by NHI Mgmt Group, based on content published by eMudhra: “Why Businesses Prefer MFA Over 2FA | India”.
By the numbers:
- In 2022, the Communications Authority of Kenya recorded over 370,000 mobile-related cybercrime reports, many involving SMS interception.
Key questions
A: SMS OTP is vulnerable because the code travels through channels attackers can intercept through phishing, malware, SIM swapping, or social engineering of telecom staff.
Q: When should organisations move from static 2FA to context-aware MFA?
A: They should move when access risk changes by device, location, user behaviour, or fraud pressure, because a fixed second factor cannot adapt to those conditions.
Q: What are the signs that account sign-in controls are not keeping up with fraud?
A: Look for repeated login bursts, device or IP reuse across many accounts, unusual proxy indicators, rising first-session abuse, and a mismatch between authentication success and downstream loss.
Practitioner guidance
- Replace SMS OTP with risk-based MFA policies Prioritise risk-based policies for banking, customer portals, and remote workforce access where SIM swap and phishing are credible threats.
- Bind authentication to trusted devices Use device fingerprinting and attestation so login decisions can distinguish enrolled devices from anomalous or unmanaged endpoints.
- Tighten account recovery and factor reset flows Review recovery steps, number-change handling, and help-desk overrides so they do not become the easiest path around stronger MFA.
Bottom line: Static 2FA is increasingly outmatched by SIM swap fraud, phishing relays, and credential stuffing in mobile-first environments.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:05 pm
Static second factors are no longer a stable security boundary: SMS OTP assumes the enrolled factor continues to belong to the legitimate user throughout the session. That assumption fails when telcos can be manipulated, phishing kits can relay codes, and users authenticate from unmanaged endpoints. The implication is that authentication governance has to move from factor presence to factor trustworthiness at the moment of login.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How should teams govern biometric and push-based MFA without creating new weak points?
A: They should govern enrollment, device binding, and recovery as part of the same authentication policy. Biometrics and push approval reduce relay risk, but weak reset processes or unmanaged enrollment can reintroduce the very bypasses stronger factors were meant to close.
👉 Read our full editorial: Context-aware MFA is replacing static 2FA in Kenyan enterprises