Multi-factor authentication (MFA) significantly improves account security compared to using a password alone. That much is widely understood. What is less well known is that not all MFA methods protect against phishing — and some of the most common MFA methods can be bypassed by determined attackers in seconds. Understanding the difference between "MFA" and "phishing-resistant MFA" could be the key to keeping your accounts safe from the most sophisticated attacks in 2026.

This article breaks down the hierarchy of MFA methods from least to most phishing-resistant, explains exactly how each one can be bypassed, and shows you which standards actually live up to the promise of stopping phishing.

What Is AiTM Phishing?

Before examining individual MFA methods, it is important to understand the technique that breaks most of them: adversary-in-the-middle (AiTM) phishing. Unlike traditional phishing where an attacker simply captures your credentials on a fake page, AiTM phishing sets up a proxy between you and the legitimate service. When you type your password into the fake page, the proxy forwards it to the real site. When the real site prompts for your MFA code, the proxy forwards that prompt to you. When you enter your MFA code, the proxy captures it and uses it immediately to authenticate the attacker's session on the real site.

This all happens in real time — typically in under 30 seconds. The attacker does not need to break the MFA method; they simply relay the authentication flow through you. This technique defeats any MFA method that relies on a time-based code or a simple approval prompt, which includes SMS codes, authenticator app codes, and push notifications.

The MFA Hierarchy: From Least to Most Phishing-Resistant

Level 1: SMS and Voice OTP (Least Secure)

SMS-based one-time passcodes are the most common MFA method in use today — and the easiest to intercept. Attackers have two primary ways to bypass SMS MFA. The first is SIM-swapping, where the attacker convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your number, all SMS codes sent to you arrive on their device instead. The second is AiTM phishing, where the phishing proxy captures the SMS code you enter on the fake page and uses it to authenticate the attacker's session.

SMS MFA also suffers from the fundamental problem that SMS messages are not encrypted and can be intercepted at the carrier level or through SS7 protocol vulnerabilities. NIST has recommended deprecating SMS-based MFA since 2016, yet it remains widely deployed because of its convenience and ease of setup. If you are using SMS MFA, it is better than no MFA at all — but only barely, and you should consider it a stepping stone to a stronger method.

Level 2: TOTP Authenticator Apps (Moderate Security)

Time-based one-time password (TOTP) apps like Google Authenticator, Microsoft Authenticator, and Authy generate six-digit codes that refresh every 30 seconds. These are more secure than SMS because the code is generated locally on your device and is not transmitted over the phone network. TOTP codes are also immune to SIM-swapping attacks.

However, TOTP codes can still be intercepted by AiTM phishing attacks. The attack works like this: you land on a fake login page that looks identical to the real one. You enter your password, and the phishing proxy forwards it to the real site. The real site sends back a prompt for your TOTP code, which the proxy forwards to the fake page. You read the six-digit code from your authenticator app and type it into the fake page. The proxy captures the code and uses it to authenticate the attacker's session. Within seconds, the attacker is logged into your account, and you are left staring at an error message or a redirect.

TOTP is a solid improvement over SMS, but it is not phishing-resistant. For high-value accounts — email, banking, cloud storage — you should look for something stronger.

Level 3: Push Notifications (Vulnerable to MFA Fatigue)

Push-based MFA sends a notification to your phone asking you to approve or deny a login attempt. Examples include Microsoft Authenticator's number-matching prompts, Duo Security push approvals, and Apple's "Allow" notifications. Push notifications are convenient — you tap one button and you are in — but they introduce a new vulnerability: MFA fatigue.

MFA fatigue, also called push bombing or MFA bombing, is an attack where the attacker repeatedly sends push notifications to the victim's phone — sometimes dozens or hundreds in rapid succession. The attacker hopes that the victim will eventually approve one out of annoyance, confusion, or the mistaken belief that the repeated prompts indicate a technical glitch. Once the victim approves, the attacker gains access. This attack has been used in major security incidents involving Uber, Cisco, and multiple ransomware groups.

Some push-based MFA systems now include number matching — where the login screen shows a number and the push notification asks you to enter that number, preventing accidental approvals. This helps, but it does not stop a determined attacker who combines push bombing with social engineering — for example, calling the victim pretending to be IT support and asking them to "approve the test notification on your phone." Push notifications are convenient, but they introduce a human-factor vulnerability that technical controls cannot fully eliminate.

Level 4: FIDO2/WebAuthn (Truly Phishing-Resistant)

FIDO2 and WebAuthn represent the gold standard in phishing-resistant authentication. Unlike every method above, FIDO2/WebAuthn uses cryptographic origin binding — the authenticator (whether a hardware security key like a YubiKey, or a software authenticator built into your device) cryptographically verifies the domain of the website it is communicating with before responding to any authentication request.

Here is how it works in practice: When you register a FIDO2 credential with a site, the credential is cryptographically bound to that site's domain (e.g., "google.com"). When you return to log in, the site sends a challenge to your authenticator. The authenticator checks the domain and only signs the challenge if the domain matches exactly. If you land on "g00gle.com" — even if the page looks perfectly identical — the authenticator refuses to respond. The cryptographic binding makes AiTM phishing impossible because the proxy cannot forge the domain binding.

FIDO2 credentials are also resistant to credential theft. The private key never leaves your device — it cannot be leaked in a data breach, and it cannot be extracted by malware. Each credential is unique to the service it was registered with, so registering on one site does not create a credential that could be used elsewhere.

The rise of passkeys — which are FIDO2/WebAuthn credentials that sync across your devices through your platform vendor (Apple, Google, or Microsoft) — has made phishing-resistant authentication much more accessible. You do not need to buy a separate hardware key; your phone or laptop can serve as the authenticator. Password managers like NordPass are increasingly adopting passkey support, making phishing-resistant authentication more accessible to everyday users without needing separate hardware.

Why Password Managers Still Matter with MFA

Even the best MFA — FIDO2/WebAuthn — does not eliminate the need for strong, unique passwords. Many services still only support password-based authentication with optional SMS or TOTP MFA. Until FIDO2/WebAuthn or passkeys are universal, you need strong, unique passwords for every account as your baseline security, with the best available MFA layered on top.

A password manager like NordPass generates strong, unique passwords for every account and can also serve as a TOTP authenticator for many services, consolidating both your passwords and your second factors in one encrypted vault. This makes it practical to use both unique passwords and MFA on every account, without needing to juggle multiple apps.

Practical Recommendations

Based on the hierarchy above, here are actionable steps you can take right now to improve your MFA setup:

• Move away from SMS MFA wherever possible. If a service offers TOTP or push-based alternatives, switch to those today. SMS should only be used as a fallback option.
• Enable FIDO2/WebAuthn on every service that supports it. Major platforms including Google, Apple, Microsoft, GitHub, Dropbox, and Facebook all support security keys or passkeys for authentication.
• Enable passkeys through your device ecosystem (iCloud Keychain, Google Password Manager, or Microsoft Authenticator) for a convenient, phishing-resistant experience without needing a separate hardware key.
• Use a password manager like NordPass to generate unique passwords for every account and store your TOTP seeds alongside your credentials, reducing the friction of using MFA everywhere.
• Be aware of MFA fatigue — if you receive unexpected push notifications, never approve them. Contact your IT department or the service's support team to report the suspicious activity.

Conclusion

Not all MFA is created equal. SMS codes, TOTP authenticator apps, and push notifications all provide meaningful protection against casual attackers, but they can all be bypassed by determined phishing operations using AiTM proxies or MFA fatigue techniques. Only FIDO2/WebAuthn — including passkeys — provides cryptographic protection that makes real-time phishing attacks impossible.

The practical takeaway is simple: use the best MFA method available for each service, aiming for FIDO2/WebAuthn wherever possible, and always pair MFA with unique passwords generated by a password manager. Defence in depth means layering multiple protections so that if one fails, the others still hold.