When You Have a Choice, Pick the Strongest MFA Available
Multi-factor authentication (MFA, a second proof of identity beyond your password) is one of the best defenses we have against account takeover. But MFA is not one single thing. A text message code, a push notification you tap to approve, and a physical security key or passkey all count as MFA, and they are not equally safe.
Credential phishing has climbed 967 percent since 2022, and weak or stolen passwords still sit behind roughly 80 percent of hacking-related breaches. Attackers have had years to study the weaker forms of MFA, and they have built tools specifically to get around them.
How Attackers Get Around the Weaker Options
Modern phishing kits (sold on the dark web the same way legitimate software is sold) set up a fake login page that sits between you and the real site. You type your username and password into what looks exactly like the Microsoft sign-in screen, and the kit instantly relays it to the real one.
When the real site asks for your MFA code or push approval, the fake page asks for it too and relays it in real time. The attacker uses your own code or approval the moment you give it, then steals the session that follows so they stay logged in even after you change your password.
If a method can be typed in, read off a text message, or approved with a single tap, an attacker’s fake page can ask you for it too.
Why Phishing-Resistant MFA Is Different
Phishing-resistant MFA, like a security key, Windows Hello, or a passkey, works differently. It is cryptographically bound to the real website address, not just your account. A fake copy of a login page cannot complete the handshake, because it is not the real site the key was registered to.
There is no code to read, no push to approve, and nothing for a fake page to relay. That is the entire point.
What This Means for You
When Microsoft or any other system gives you a choice of verification method, pick the strongest one offered, not the fastest one.
A simple rule of thumb when you are given a choice:
- Authenticator app approval beats a text message code every time.
- A security key or passkey beats an authenticator app when one is available to you.
- Never approve an MFA prompt you did not just trigger yourself, no matter which method it uses.
- If anything about a sign-in page or MFA prompt looks even slightly off, stop before entering anything.
MFA only protects us when we pick the strongest version available. We would rather spend thirty extra seconds on a stronger method than deal with an account takeover afterward.
