Which Kind of Multi-Factor Authentication Actually Stops Attackers

Turning on multi-factor authentication (MFA) is the single most effective security improvement most businesses can make. It stops the large majority of attacks that rely on a stolen or guessed password.

But MFA isn’t one thing. The kind you choose decides which attacks it actually stops.

From weakest to strongest

Text-message codes (SMS). Far better than nothing, but vulnerable in two ways. SIM-swap fraud — convincing a mobile carrier to move your number to an attacker’s SIM — delivers your codes to them. And a convincing fake login page can simply ask you to type the code, then use it instantly.

Email codes. Only as strong as the email account itself, which is often the very account being protected.

Push notifications. Convenient, but vulnerable to MFA fatigue: an attacker with your password triggers approval prompts repeatedly until someone taps approve just to make them stop. This technique has featured in several high-profile breaches. Number matching — typing a number shown on the login screen into the app — largely defeats it.

Authenticator apps (time-based codes). Not tied to your phone number, so SIM swaps don’t work. Still phishable: a fake login page can ask for the six-digit code and relay it in real time.

Passkeys and FIDO2 security keys. Phishing-resistant. The credential is cryptographically bound to the real website, so a fake login page receives nothing it can use. This is what security agencies, including the U.S. Cybersecurity and Infrastructure Security Agency, recommend for high-value accounts.

A practical plan

You don’t need to jump straight to the strongest option everywhere:

1. Turn on MFA for every account that supports it. Any MFA beats none.
2. Prioritise email and admin accounts. Email is the recovery path for nearly everything else, and admin accounts can undo every other control.
3. Enable number matching if you use push approvals.
4. Move away from SMS where an authenticator app or passkey is available.
5. Use passkeys or security keys for administrators, finance staff, and anyone who can approve payments.

Don’t forget the gaps

MFA only protects the accounts it’s switched on for. The common gaps: legacy protocols that bypass MFA entirely, service accounts exempted “temporarily”, and shared mailboxes nobody thinks of as a login.

MFA is also the control that stops most of the business email compromise we investigate. Rollouts and audits are part of our cybersecurity practice.