Should organisations use breached-password checks in addition to MFA?

Why breached-password checks and MFA solve different parts of the login problem

Breach screening and MFA are complementary controls, not substitutes. Breached-password checks reduce the odds that a known-compromised password is accepted at all, while MFA raises the attacker’s cost if a password is stolen, reused, or guessed. Together they address both password quality and authentication strength, which is why one control does not make the other redundant.

That distinction matters because real-world account takeovers often begin with a valid password, not a broken authenticator. Password spraying, credential stuffing, and reused credentials remain effective when organisations rely on MFA alone but never screen passwords against breach corpora. Likewise, breached-password checks do not protect against every theft path, especially session theft, MFA fatigue, or token replay.

Breached-password screening is most useful at password creation, password reset, and account recovery, where the organisation still has a chance to stop a known-bad secret before it becomes part of the account lifecycle. It is a quality-control step for the credential itself. MFA is a separate access decision that verifies a second factor or a stronger authenticator at sign-in time, so it protects a different point in the flow.

How the two controls work together in practice

The cleanest operating model is to treat breached-password checks as a gate on password acceptance and MFA as a gate on account use. If a user chooses or resets to a password that appears in breach lists, reject it and force a new one; then require MFA so that a valid password alone is still insufficient for access. That combination reduces both the probability and the impact of password compromise.

For workforce environments, this pair is especially important where password reuse, help-desk resets, and legacy authentication still exist. The strongest deployments combine breached-password screening with phishing-resistant MFA, because a password check cannot stop real-time phishing or token theft on its own. NHIMG’s MFA Guide explains why attackers bypass weaker MFA methods and why phishing-resistant options materially change the risk profile.

For account recovery paths, the control boundary matters even more. If the recovery process can be abused to replace a password without checking it against known breaches, an attacker may turn a recovered account into an easy target. That is why organisations should apply breach screening not only to new passwords, but also to reset flows and any self-service change that effectively creates a new credential.

Where this control pair still fails, and what to watch

Even strong password screening does not eliminate attack paths that bypass the password entirely. If an attacker steals a session cookie, tricks a help desk, abuses a recovery channel, or captures a one-time code through phishing, breached-password checks offer little protection. The control is also only as good as its coverage of the password at the moment of acceptance, not after the fact.

23andMe credential stuffing 2023 is a useful reminder that reused passwords can still drive large-scale account compromise when organisations do not stop known-bad secrets early. By contrast, CitrixBleed exploitation 2023 shows why MFA cannot be treated as a complete defence when session tokens are stolen and replayed.

Organisations should also watch for operational gaps: password checks that cover only self-service signup but not admin-created accounts, stale breach lists, poor localisation of error messages that leak policy details, and exceptions for legacy systems that undermine the control at scale. When those exceptions accumulate, the result is often a false sense of security rather than a meaningful reduction in takeover risk.

Practitioner Guidance

What to prioritise: Make breach screening mandatory for every password set or reset path, then require MFA on top of it. If either control is optional, the weaker path becomes the one attackers will find first.

Decision rule: If the user can authenticate with a password alone, treat breached-password checks as a necessary but incomplete control. If the environment also has phishing, help-desk abuse, or session-theft exposure, move toward phishing-resistant MFA rather than stopping at SMS or push approval.

What to verify: Confirm that the breached-password check runs against current breach intelligence, covers all password lifecycle events, and is enforced uniformly across workforce, partner, and admin accounts. A control that only applies during initial signup leaves the reset path exposed.

Practitioner takeaway: Use breached-password checks to reduce password acceptability, and MFA to reduce password usefulness; the security gain comes from stacking them, not choosing between them.

Related resources from NHI Mgmt Group

• Should organisations still use one-time passwords for MFA?
• What breaks when organisations use fast general-purpose hashes for password storage?
• Should organisations use breach monitoring before changing password policy?
• How should organisations use MFA to support CMMC readiness?