Social engineering attacks on MFA are rising fast. Security teams often assume MFA stops credential theft, but attackers now aim to trick users into approving malicious logins. Methods include phishing for one-time passcodes, SIM swapping to intercept SMS codes, push fatigue attacks flooding users with approval requests, and fake IT support calls that guide targets through “verification” steps.
MFA bypass through social engineering works because authentication relies on human action. An attacker can impersonate trusted contacts, exploit urgency, and manipulate users into granting access. Even hardened systems become vulnerable when the person at the keyboard believes the request is legitimate.
Defense demands more than enforcing MFA. Use phishing-resistant factors like FIDO2 or WebAuthn, which remove codes from the process entirely. Apply conditional access policies that limit approvals to known devices and networks. Monitor for abnormal login patterns and repeated push notification attempts. Train users to treat every MFA prompt as suspicious if they did not initiate the login themselves. Decommission SMS-based MFA for sensitive systems.