Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
MFA makes account takeover harder, but it is not one uniform safeguard: attackers can exploit phishable codes, overwhelm users with push prompts, hijack phone-based codes, or steal an authenticated session after login. The strongest direction is phishing-resistant authentication such as FIDO/WebAuthn or passkeys, paired with protections for devices and sessions.
How attackers get around MFA
Most MFA bypasses do not mean an attacker has defeated every factor mathematically. They exploit a weakness in how a particular method is delivered, approved, or maintained after sign-in. The distinction matters: a six-digit code that a user can type into a fake website is still useful against many password-only attacks, but it is not inherently resistant to phishing.
CISA identifies phishing, push bombing, SS7 exploitation, and SIM swapping among the risks associated with some MFA methods in its Implementing Phishing-Resistant MFA fact sheet, published in October 2022. Microsoft’s identity guidance also describes adversary-in-the-middle attacks and token theft as ways attackers can establish or maintain access. The practical question is therefore not simply whether an account has MFA, but which method it uses and what happens after authentication.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsPhishing can relay a login in real time
A fake sign-in page can ask for a password and an authenticator code, then forward those details to the real service. In an adversary-in-the-middle (AiTM) attack, the attacker relays the victim’s interaction through to the legitimate sign-in flow and may capture session material returned after authentication. Microsoft describes AiTM phishing as a way to bypass traditional MFA and gain access through token theft. Microsoft Learn reports a 146% rise in AiTM phishing attacks over the prior year, attributing the figure to the 2024 Microsoft Digital Defense Report. That is Microsoft’s reported figure, not a universal independently verified measure.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
FIDO/WebAuthn authentication, including passkeys and FIDO2 security keys where supported, is designed to resist phishing by binding authentication to the legitimate service rather than relying on a code a user can copy to a lookalike site. CISA identifies FIDO/WebAuthn as phishing-resistant, and Microsoft lists FIDO2 keys and passkeys among deployment options. See CISA’s MFA guidance and Microsoft’s phishing-resistant MFA guidance.
“Phishing-resistant” is not a promise that every related account process is equally safe. Compatibility depends on the identity provider, platform, and configuration; enrollment, recovery, and fallback methods also matter. An account that uses a passkey for routine sign-in but permits easy fallback to a phishable code still has a weaker path attackers may target.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Push fatigue turns repeated prompts into an approval attack
In a push-fatigue attack, an attacker who already knows or has obtained a user’s password repeatedly triggers sign-in approval notifications. The attacker hopes the person will tap “approve” accidentally, out of confusion, or simply to stop the interruptions. The prompt is the attack surface: the user is being asked to make a security decision under pressure.
Number matching makes blind approval less useful by requiring the user to enter a number shown on the sign-in screen into the authenticator app. CISA describes this as a mitigation for push bombing and recommends it when an organization cannot yet implement phishing-resistant MFA. It is an interim defense against indiscriminate prompt acceptance, not a substitute for phishing-resistant authentication or a general fix for stolen sessions. Details are in CISA’s number-matching fact sheet.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
SMS and voice codes inherit telecom risks
Text and voice codes can be exposed through weaknesses in phone-number delivery. CISA describes SIM swapping, in which social engineering results in a phone number being transferred to an attacker-controlled SIM, and exploitation of SS7 telecom signaling vulnerabilities that can enable interception of SMS or voice communications. If an attacker obtains the code, the second step may no longer be a meaningful barrier. Codes can also be captured by phishing, even without a telecom compromise.
This does not mean every text message is intercepted or that MFA is pointless. It means phone-delivered codes should not be treated as equally robust as phishing-resistant methods. CISA’s More than a Password guidance and its phishing-resistant MFA fact sheet describe the broader differences among MFA approaches.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
A successful login does not secure a stolen session
Authentication is a moment in time; a session token can keep a user signed in afterward. Microsoft explains that an attacker who steals a valid token may replay it to access resources without repeating the original authentication challenge. In that case, the problem is not that the attacker guessed the second factor—the attacker is attempting to reuse the authenticated session.
Microsoft discusses token protection that binds tokens to the intended device in supported scenarios. Its availability is not universal across every platform or application. Organizations also need endpoint security, session controls, and detection to address other parts of the attack chain. Microsoft’s overview is in Security guidance: Protect identities and secrets; token concepts and protection details are in Understanding Tokens in Microsoft Entra ID.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
What to prioritize when choosing or improving MFA
There is no universal ranking that covers every vendor configuration, recovery process, or device. Compare methods by the attack paths they address and the practicalities of deploying them:
Quick Recap
| Method or control | Phishing and real-time relay | Telecom exposure | Push fatigue | Post-login session | Deployment considerations |
|---|---|---|---|---|---|
| FIDO/WebAuthn, including passkeys or FIDO2 security keys | Identified by CISA as phishing-resistant; service and configuration support still matter. | Does not rely on SMS or voice delivery for the authentication step. | Not a push-approval method. | Does not by itself stop replay of a stolen session token. | Check identity-provider, platform, device, recovery, and fallback compatibility. |
| Authenticator-app code | A code that can be typed into a fake sign-in page may be phished. | Not delivered through the phone carrier’s SMS or voice channel. | Not applicable to code entry. | Does not by itself protect an issued session token. | Users still need to distinguish the real sign-in from a phishing page. |
| Push approval | Approval prompts can be abused in an attack; number matching makes blind approval less useful. | Not a phone-number code delivery method. | Repeated prompts can pressure or confuse a user. | Does not by itself protect an issued session token. | Number matching is an interim mitigation, not phishing resistance. |
| SMS or voice code | Codes can be captured through phishing. | Exposed to risks including SIM swapping and SS7 exploitation. | Not applicable to push approval. | Does not by itself protect an issued session token. | Better than no additional factor, but should not be mistaken for the strongest option. |
| Token protection and session controls | Not a replacement for phishing-resistant authentication at sign-in. | Not a phone-code method. | Does not prevent prompt fatigue. | Addresses aspects of token theft and session replay where supported. | Support depends on platform and application; verify the applicable environment. |
Practical steps for individuals and organizations
- Move priority accounts toward phishing-resistant sign-in. Check whether the identity provider and the devices people use support passkeys or FIDO2 security keys. Confirm that recovery and fallback routes do not quietly reintroduce an easy-to-phish method.
- Harden push approval if migration will take time. Enable number matching where available, and tell users to deny unexpected requests and report repeated prompts rather than approving one to stop the disruption.
- Reduce reliance on phone-delivered codes. Where a stronger supported method is available, prefer it for important accounts. Keep recovery procedures deliberate, since recovery can become an alternate route around the primary sign-in method.
- Protect the endpoint and active session. Apply available device security and session controls, investigate suspicious sign-ins, and use token protection only where the platform and application support it.
- Review the full sign-in path. Assess primary authentication, fallback factors, account recovery, device state, and post-login session handling together; securing only the first prompt leaves other attack paths open.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
