# Can phishing get past multi-factor authentication?

Yes, some kinds of MFA can be bypassed, which is why the type matters. In an adversary-in-the-middle attack, the phishing page sits between you and the real login page: it passes your password and your one-time code or push approval to the real service in real time, then keeps the session cookie the service sends back. With that cookie the attacker is logged in without needing your password or MFA again. SMS codes, authenticator app codes and simple push approvals are all exposed to this. Phishing-resistant MFA, meaning FIDO2 security keys and passkeys, is not, because the key checks the web address and refuses to answer a fake site. MFA of any kind is still far better than none. Practical steps: give passkeys or security keys to administrators and finance first, enable sign-in policies that flag unfamiliar devices and locations, and revoke sessions, not only passwords, after any phishing incident.

FAQ: [Phishing and e-mail aftermath](https://netsenx.com/en/faq/phishing) · https://netsenx.com/en/faq/can-phishing-bypass-multi-factor-authentication

## Read next

- https://netsenx.com/en/is-someone-inside-your-network
- https://netsenx.com/en/what-is-ndr

## Related questions

- [Does a password reset end a mailbox takeover?](https://netsenx.com/en/faq/does-a-password-reset-end-a-mailbox-takeover)
- [What are deepfake CEO calls, and how do we protect against them?](https://netsenx.com/en/faq/what-are-deepfake-ceo-calls)
- [What is a fake CAPTCHA or ClickFix attack?](https://netsenx.com/en/faq/what-is-a-fake-captcha-clickfix-attack)
- [Are e-mail attachments still dangerous?](https://netsenx.com/en/faq/are-email-attachments-still-dangerous)
- [What does NetSenX see after someone clicks a phishing link?](https://netsenx.com/en/faq/what-does-netsenx-see-after-a-phishing-click)