Can phishing get past multi-factor authentication?

Yes, some kinds of MFA can be bypassed, which is why the type matters. In an adversary-in-the-middle attack, the phishing page sits between you and the real login page: it passes your password and your one-time code or push approval to the real service in real time, then keeps the session cookie the service sends back. With that cookie the attacker is logged in without needing your password or MFA again. SMS codes, authenticator app codes and simple push approvals are all exposed to this. Phishing-resistant MFA, meaning FIDO2 security keys and passkeys, is not, because the key checks the web address and refuses to answer a fake site. MFA of any kind is still far better than none. Practical steps: give passkeys or security keys to administrators and finance first, enable sign-in policies that flag unfamiliar devices and locations, and revoke sessions, not only passwords, after any phishing incident.

← All 29 questions on Phishing and e-mail aftermathAll topics