Why Traditional MFA Isn’t Phishing-Resistant

Yubikey

For years, one of the most important pieces of cybersecurity advice has been simple:

Enable Multi-Factor Authentication (MFA).

That advice still holds true. MFA provides a significant security improvement over relying on a password alone.

But not all MFA is created equal.

Traditional MFA methods can still be defeated by modern phishing and social-engineering attacks. That's why organizations should increasingly be looking toward phishing-resistant authentication methods such as FIDO2 security keys and passkeys.

Traditional MFA Still Relies on the User

Traditional MFA typically combines your password with an additional authentication factor.

For example, you might:

1. Enter your username and password.

2. Receive a one-time passcode on your phone.

3. Enter that code to complete authentication.

   
   

An attacker who steals your password still needs that second factor, which makes the account substantially harder to compromise.

The problem is that some second factors can also be socially engineered from the user.

An attacker could create a convincing fake login page that captures your password and then asks for your one-time code. If you provide both, the attacker can potentially relay those credentials to the legitimate service and authenticate as you.

MFA worked exactly as designed.

The attacker simply tricked the user into providing both factors.

Phishing-Resistant Authentication Changes the Equation

Phishing-resistant authentication is designed to remove this weakness.

Consider a FIDO2 hardware security key, such as a YubiKey.

When authenticating, you may be asked to:

• Insert or interact with your physical security key.

• Enter the PIN associated with the key.

• Complete authentication using the cryptographic credentials stored on the device.

  
  

There's an important difference here.

You physically possess the security key. The attacker doesn't.

Even if an attacker convinces you to reveal the PIN you know, the PIN by itself isn't enough. They would also need possession of the physical security key.

Moving Beyond Passwords

Passwords have been foundational to authentication for decades, but they have an inherent weakness:

They're secrets that people can give away.

The same problem applies to weaker authentication factors such as SMS and voice-based verification. If a user can communicate an authentication secret to someone else, an attacker can potentially devise a way to obtain it.

Modern authentication is increasingly moving toward technologies such as:

• Passkeys

• FIDO2 security keys

• Device-bound credentials

• Certificate-based authentication

  
  

Rather than asking users to protect more secrets, these technologies use cryptography and trusted devices to make authentication significantly more difficult to steal or relay.

Does This Mean Traditional MFA Is Bad?

Absolutely not.

Traditional MFA is still substantially better than password-only authentication.

If your organization hasn't deployed MFA, implementing it should remain a priority.

The important distinction is that deploying MFA shouldn't necessarily be viewed as the end of your identity security journey.

A more mature strategy is to ask:

What type of MFA are we using, and how resistant is it to the attacks we're likely to face?

Organizations can then progressively move higher-risk users toward stronger authentication methods.

Executives, IT administrators, HR personnel, finance teams, and other high-value targets can be particularly strong candidates for phishing-resistant authentication.

Final Thoughts

The cybersecurity industry spent years telling organizations to "turn on MFA."

Now the conversation needs to mature.

The next question should be:

"What kind of MFA?"

Passwords combined with SMS codes or other traditional factors provide valuable protection, but attackers have adapted.

Passkeys, FIDO2 security keys, and other phishing-resistant authentication technologies provide organizations with an opportunity to adapt as well.

At Redeemer Cyber, our Microsoft 365 Security Assessments evaluate how MFA and authentication are actually implemented—not simply whether an MFA checkbox is turned on.

And through our Microsoft 365 Remediation services, we can help organizations move from basic MFA toward a modern, phishing-resistant authentication strategy that makes sense for their users and their environment.

Contact Redeemer Cyber today to assess and strengthen your Microsoft 365 identity security.