iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes, attackers can bypass some multifactor authentication (MFA), but “bypass” usually means defeating a particular login flow—not magically defeating every second factor. Phishing can steal passwords and one-time codes, adversary-in-the-middle (AiTM) proxies can relay a live login and capture its session, push fatigue can manipulate an approval, and SIM swaps can redirect text messages. A stolen session token may let an attacker skip a new MFA prompt entirely.
The strongest practical defense is phishing-resistant authentication: a FIDO2 security key or passkey that proves the legitimate website’s origin with public-key cryptography. It blocks the credential-relay techniques that defeat passwords, TOTP codes and approval prompts. It does not, by itself, solve unsafe enrollment, account recovery, malware, stolen devices or unprotected sessions, so those controls still matter.
What “bypassing MFA” actually means
MFA combines two or more categories of evidence, such as something you know (a password), something you have (a security key or phone) and something you are (a biometric). Adding a second factor substantially raises the attacker’s cost, especially when a password has been exposed. It does not make every authentication ceremony equally resistant.
Free tools Windows power users keep installed
One-click scans. No signup required.
An attacker can target different points in the process:
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
- Capture: trick the user into entering a password or code into an impostor site.
- Relay: pass the victim’s live login exchange through a proxy to the real service.
- Approval: pressure the user to accept a prompt they did not initiate.
- Delivery: intercept a code sent over the phone network.
- Session: steal an already valid browser token so no new MFA challenge is needed.
- Lifecycle: abuse enrollment, reset or recovery procedures that are weaker than the normal sign-in.
“MFA bypass” therefore has to be evaluated against a specific method, protocol and attack path.
At-a-glance: what each attack can defeat
| Attacker method | Can defeat | Usually cannot defeat | Best control |
|---|---|---|---|
| Credential phishing | Password plus a code or approval when the victim enters it into a counterfeit page | A correctly implemented phishing-resistant key or passkey bound to the legitimate service | FIDO2/passkeys, domain controls and user training |
| Adversary-in-the-middle (AiTM) relay | A live login exchange and, in some deployments, the resulting session token | Origin-bound cryptographic proof | FIDO2/passkeys, token protection and conditional access |
| Push bombing (MFA fatigue) | Approval-only push workflows when a user eventually accepts | Controls that require deliberate number or secret transfer, and methods that do not rely on approval alone | Number matching, rate limits, reporting and phishing-resistant MFA |
| SS7 abuse | SMS or voice-delivered MFA codes | Authenticator apps, hardware keys and passkeys that do not use phone-network delivery | Remove SMS/voice as the primary factor; use FIDO2/passkeys |
| SIM swap | SMS or voice codes after a number is moved to an attacker-controlled SIM | Hardware keys and passkeys not tied to the phone number | Carrier account protections plus phishing-resistant MFA |
| Session-token theft | Fresh reauthentication prompts, because a valid token is replayed | Tokens bound to the intended device and protected by revocation and access policy | Token protection, device controls and rapid revocation |
| TOTP seed or code theft | Time-based one-time-password MFA if the secret or current code is captured | A properly implemented origin-bound FIDO2/passkey ceremony | Migrate from shared-secret OTP to phishing-resistant methods |
Credential phishing and AiTM relays
How the attack works
A conventional phishing page imitates a familiar sign-in screen and asks for the username, password and six-digit authenticator code. The attacker can use those values immediately against the real service. An AiTM proxy makes the process more convincing: it sits between the victim and the legitimate site, forwards each request and response in real time, and may capture the session cookie issued after successful MFA.
This defeats factors whose output can be typed, copied or approved through a relay. A TOTP code is valid for a short interval, but a live proxy only needs to forward it before it expires. A push approval can be relayed by persuading the user to accept the request.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What stops it
FIDO2 security keys and passkeys use a key pair created for a specific relying party (the legitimate service). During sign-in, the authenticator checks the website origin and signs a challenge; it does not disclose a reusable secret to a look-alike domain. NIST describes phishing resistance as the ability of an authentication protocol to prevent disclosure of authentication secrets and valid outputs to an impostor relying party without depending on the subscriber’s vigilance. That origin binding is why a counterfeit site cannot simply collect a passkey response and replay it elsewhere.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Microsoft summarizes the operational implication as: “Traditional MFA is no longer enough—phishing-resistant MFA is the new baseline.” A passkey still needs a secure device, correct service implementation and protected recovery path; it is not a guarantee against malware controlling a signed-in endpoint.
Push bombing and MFA fatigue
Why approval-only prompts are vulnerable
In a push-bombing attack, the criminal already has a password or is repeatedly attempting login while sending notifications to the victim’s phone. Dozens of alerts can create urgency, confusion or simple fatigue. One accidental tap on Accept completes the attacker’s login.
CISA calls this “push bombing” or “push fatigue.” The weakness is behavioral: the system asks the user to approve an event without proving which event they are approving.
Recommended Free Tools
Number matching helps, but is not equivalent to a security key
Number matching displays a number on the sign-in screen and requires the user to enter that number in the authenticator app. It sharply reduces blind, accidental approvals. Rate limits, location and device risk checks, and a prominent “report this request” option add friction for the attacker.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
However, number matching remains a user-mediated flow. A convincing real-time phish can show the same number and coach the victim through it. NIST recommends transferring an authentication secret for out-of-band authentication rather than relying on approval alone; number matching improves that design but should not be described as equivalent to FIDO2 origin binding.
What to do when an unexpected prompt arrives
- Do not approve it, even if prompts continue.
- Use the app’s report or deny function, if available.
- Change the password from a known-clean device if it may have been exposed.
- Review recent sign-ins, revoke active sessions and notify the security team.
- Ask an administrator to reset the authenticator if repeated prompts continue after the password change.
SS7 interception and SIM swapping
SS7 abuse targets the phone network
Signaling System 7 (SS7) is the set of protocols carriers use to route calls and text messages. Attackers who obtain access to SS7 infrastructure or exploit carrier weaknesses may redirect or read SMS and voice traffic, including MFA codes. The attack does not break the cryptography of a hardware key; it attacks the delivery channel.
A SIM swap moves your number
In a SIM-swap fraud, the attacker persuades a carrier representative—or abuses a compromised carrier account—to transfer your phone number to a SIM or eSIM they control. Password-reset links and SMS or voice MFA codes then arrive on the attacker’s device. The victim may notice loss of service, but the takeover can begin before that symptom is investigated.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →CISA identifies both SS7 abuse and social engineering of carriers as reasons not to treat text or voice codes as a strong factor. Carrier account PINs, a port-out lock and an in-person identity requirement can reduce risk, but they do not turn SMS into phishing-resistant authentication.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Which methods remain available after a SIM swap?
A FIDO2 security key and a passkey are not tied to a telephone number, so moving the number does not transfer the credential. An authenticator app with a locally stored secret also avoids the phone network, although its seed or current code can still be phished or stolen from a compromised device. If SMS is the only recovery method, an attacker may still use it to reset a stronger primary factor; recovery must therefore receive the same scrutiny as normal sign-in.
Stolen session tokens
Why a token can bypass a new MFA challenge
After successful authentication, a service gives the browser a session token or cookie that represents the completed login. If malware, an infostealer, a malicious browser extension or an AiTM proxy copies that token, the attacker can replay it from another device. Microsoft explains that a stolen sign-in token can bypass a fresh MFA challenge because it is already valid proof of an authenticated session.
This is not a failure of the second factor at the moment it was used. The attacker is reusing the result of a completed authentication.
Controls that limit replay
- Token protection: bind tokens cryptographically to the intended device so a copied value is not useful elsewhere.
- Shorter session lifetimes: reduce the window in which a stolen token remains valid, balancing security against user disruption.
- Conditional access: require a managed, healthy device, expected location or compliant risk state for sensitive actions.
- Continuous evaluation and revocation: invalidate sessions promptly after a password reset, device loss or detected compromise.
- Endpoint hardening: patch browsers and operating systems, restrict extensions and use malware defenses that protect credential stores.
A phishing-resistant sign-in makes initial credential theft harder, but it cannot retroactively invalidate a token that has already been stolen. Token and endpoint protections are separate requirements.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
TOTP seed and code theft
Time-based one-time passwords (TOTP) are generated from a shared secret stored by the service and the authenticator app. If an attacker obtains the seed—through a backup export, malware, a support scam or an exposed enrollment QR code—they can generate valid codes indefinitely until the seed is reset. Stealing only the current six-digit code is usually more time-sensitive, but a live phishing relay can use it immediately.
Moving from TOTP to FIDO2 or passkeys removes the shared secret from the login exchange and binds the cryptographic response to the legitimate origin. Protect the enrollment ceremony: require an already trusted factor, verify the device and user, record which authenticators were added and alert on unexpected changes.
Choosing the strongest MFA method
CISA’s practical ordering is a useful baseline:
- Physical security key: best protection against phishing because the key performs origin-bound cryptographic authentication.
- Authenticator-app number matching: stronger than approval-only push, but still dependent on the user and the app flow.
- App-generated one-time codes: avoid phone-network interception, yet remain phishable and vulnerable if the seed is stolen.
- Biometrics where supported: often unlock a device-bound key; they are not automatically a separate remote factor and depend on the device’s implementation.
- SMS or email codes: use only when stronger methods are unavailable; CISA lists them as the weakest option.
For administrators, make phishing-resistant methods the default for privileged, financial and high-impact accounts. Keep a second registered security key in a secure location, document emergency recovery and do not leave SMS as an unreviewed fallback.
Deployment checklist: controls beyond the authenticator
Enrollment
- Require strong proof before adding a new key, passkey or authenticator.
- Notify the user and security team whenever an authenticator is enrolled, removed or replaced.
- Use separate approval for high-risk enrollment, rather than trusting the same compromised session.
Recovery
- Audit password-reset, help-desk and lost-device procedures for weaker identity checks.
- Provide recovery codes or a second physical key stored securely; do not make SMS the only escape route.
- Log every recovery event and force review of active sessions after recovery.
Endpoint and session security
- Keep operating systems, browsers and authenticator applications patched.
- Restrict risky extensions and monitor for infostealers.
- Apply device compliance, token protection and rapid revocation for sensitive systems.
- Teach users to report unexpected prompts, password-reset messages and carrier-service loss immediately.
What to do after a suspected bypass
- From a clean device, disable or lock the affected account and revoke all active sessions and refresh tokens.
- Reset the password and any exposed TOTP seed; do not reuse the old password.
- Check authenticator enrollment, recovery methods, mailbox forwarding rules and recent sign-ins.
- Contact the mobile carrier if service was lost or a SIM change is suspected, and add a port-out lock.
- Preserve sign-in logs, proxy alerts, endpoint evidence and carrier notices for investigation.
- Re-enroll a phishing-resistant key or passkey only after the account and recovery path are verified.
The incident is not closed when the password changes. A stolen session can remain active, and an attacker may have added their own authenticator or recovery address.
Bottom line for individuals and teams
MFA remains one of the highest-value account protections, but its resistance depends on the protocol. Phishing, AiTM relays and TOTP theft can defeat secrets that users type; push fatigue can defeat approval-only workflows; SS7 abuse and SIM swaps target phone delivery; and stolen sessions can bypass a new challenge altogether. FIDO2 security keys and passkeys provide the strongest general defense because their cryptographic proof is bound to the legitimate service. Pair them with protected enrollment and recovery, secure endpoints, device-bound tokens, conditional access and fast session revocation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
