What MFA Actually Protects You Against

A password is something you know. A second factor is something you have.

That’s the whole concept, and here’s the image that makes it stick: a burglar who copies your front door key still can’t get in if the door also needs your thumbprint. The key was necessary. It stopped being sufficient.

The two things people say about MFA are that it’s a magic switch that ends hacking, and that it’s already broken so why bother. Both are lazy. The truth is more useful than either, and it comes down to a specific question: which kind of second factor did you pick?

One stolen password, two very different Tuesdays

Step through what happens after someone gets your password. The first stage is identical either way. The fork is whether a second factor exists — and then what sort it is.

1. Step 1 of 5

   The starting point is the same either way

   Someone has your correct password. Not guessed — lifted from a breach somewhere else, or typed by you into a very convincing fake login page. Right now, at this exact moment, your password is doing precisely zero work for you.

2. Step 2 of 5

   Path A — no second factor: they are simply in

   The password was the whole lock, so a correct password is the whole key. No alarm, no friction, no clue anything happened. This is not an exotic scenario — it is how the large majority of everyday account takeovers actually go.

3. Step 3 of 5

   Path B — a second factor: the login hits a wall

   The site asks for something the password cannot supply — a code on your phone, a tap on a key in your pocket. They have one of the two things. They stop here. This is MFA doing exactly the job it is superb at.

4. Step 4 of 5

   Where Path B still loses: the code gets relayed

   A fake login page takes your password, then says "enter your code" — and passes both to the real site within seconds, while the code is still alive. You typed a completely valid code. You just typed it into the wrong window. SMS, email and app codes all fall to this, because all three are secrets you can be talked into reading out.

5. Step 5 of 5

   Where Path B holds: a passkey has nothing to hand over

   A passkey signs a challenge with a private key that never leaves your device, and the signature is mathematically welded to the real site’s address. On the fake site there is no code to read out, nothing to type, and nothing the attacker can forward. The relay attack shows up and finds the shelves empty.

What MFA kills stone dead

Every one of these is defeated by any second factor, including the ones security people sniff at:

Credential stuffing. Someone replaying a password leaked from another site. They’ve got one thing and need two. Dead. And this is the big one — it’s the mechanism behind most consumer account takeovers, full stop.

Password spraying. Trying Winter2026! against ten thousand employees and seeing who bites. Someone always bites. MFA means it doesn’t matter.

That breach dump from 2019. Your old password has been circulating for years in lists that get traded like football stickers. MFA renders it inert.

Keyloggers, shoulder-surfing, the shared spreadsheet of team passwords, the sticky note. All of these leak the password. None of them leak the phone in your pocket.

Add those up and it’s the overwhelming majority of real account compromise. So before anything else:

Turning on any MFA — even the weakest kind — is an enormous improvement over none. Do not let “but SMS isn’t perfect” delay you by a single day.

Perfect is genuinely the enemy of good here. It is depressingly common for an account to sit with no MFA at all for a year because somebody read that SMS is weak and decided to research the ideal option first. The research never happens. The account stays open.

What walks straight past it

Real-time phishing relays. This is the big one. The fake site forwards everything you type to the real site as you type it. You enter a valid code; it gets used four seconds later while it’s still good. This defeats SMS, email codes, and authenticator apps equally — because all three are just shared secrets you can be persuaded to read out. That’s the common weakness. If it can be spoken aloud, it can be relayed.

Push fatigue. If your second factor is “tap Approve”, an attacker can hammer that prompt at 2am until you tap it to make the buzzing stop. Or — and this is depressingly effective — ring you, say they’re from IT, and helpfully explain that approving will fix the glitch. We wrote about why this works; the short version is that the prompt asks you a question you have no way to answer correctly.

Session hijacking. Important and widely misunderstood. MFA protects the login. Once you’re in, the site hands your browser a cookie that says “this one’s fine, let them through”. Malware or a dodgy browser extension that steals that cookie never logs in at all — it walks in already authenticated. It’s the difference between picking the lock and finding the door propped open.

SIM swapping. If your factor is an SMS, it belongs to your phone number, and phone numbers can be moved to someone else’s SIM by sweet-talking a carrier employee. This is a well-worn play against anyone worth targeting.

Account recovery. The best front door in the world is decorative if the back door is “what was your first pet’s name?” — a question your Facebook has publicly answered since 2011. Recovery flows are very often the weakest way in.

So which factor should you actually use

In increasing order of how much punishment they take:

SMS codes. The weakest, and still hugely better than nothing. Phishable, SIM-swappable. Use it where it’s the only thing offered — which is still a depressing number of banks.

Authenticator app codes (TOTP). Better. No carrier in the loop, works on a plane, no SIM to steal. Still phishable, because it’s still a number you can be talked into typing into the wrong box.

Push with number matching. The login screen shows a two-digit number and you type it into your phone. This is a genuine step up, because passively tapping “yes” stops being possible — you now need information that only exists on the screen you’re actually sitting in front of. If you’re stuck with push, turn this on today; it’s a config toggle in every major identity provider.

Passkeys and hardware security keys. The only category that ends phishing as a class of problem. The secret never leaves the device, and the signature is bound to the genuine domain. There’s nothing to read out, so there’s nothing to trick you into reading out. Your device simply refuses to sign for the wrong site — and unlike you, it cannot be having a bad day, be in a rush, or find the attacker convincing.

That last point is the real magic, and it’s worth stating plainly:

Passkeys don’t ask you to spot the fake site. They make it impossible for the fake site to use what it collects.

What to actually do this week

1. Put the strongest available factor on your email first. Not your bank — your email. It’s the reset mechanism for everything else you own. Protect it like it’s the keys to the building, because it is.
2. Turn on passkeys anywhere they’re offered. Usually one screen in security settings, usually takes ninety seconds.
3. Move off SMS where something better exists. Keep SMS only where it’s the only option.
4. Save your recovery codes somewhere real — in your password manager, not as a screenshot in your camera roll next to photos of your lunch. The most common way people lose an account to MFA is losing the factor, not being attacked.
5. Go and read your account recovery settings. Right now. Most people have never looked. You will probably find a phone number you gave up in 2019 and an old backup email you can no longer access. Both are doors, and someone else may be holding the handle.

The one thing to take away

MFA isn’t a wall. It’s a filter — and a very good one. It removes the entire category of attack that starts with “someone else already knows your password”, which is most of them.

The attacks that get through are targeted, real-time, and comparatively rare — and one specific choice, passkeys, removes most of those too.

Turn something on today. Upgrade the factor when you can. In that order.