What Is Multi-Factor Authentication and Why Does It Fail?
Key takeaways
- Multi-factor authentication blocks the large majority of credential-based takeovers, so any account reachable by email should have it enabled before any other control.
- SMS codes fail because the phone number can be moved to another SIM, which is why carrier-level protections matter as much as the code itself.
- Push approvals fail through relay attacks and fatigue: an attacker who controls the password can send prompts until a distracted user taps approve.
- Account recovery is the real back door, because a help desk that resets a factor on a weak identity check undoes every other control you bought.
- Phishing-resistant factors such as passkeys and hardware security keys are the only versions that survive a credential-phishing page.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What is multi-factor authentication in simple terms?
Multi-factor authentication means a login needs two different kinds of proof. The first is something you know, such as a password. The second is something you have, such as a phone with an SMS code or an authenticator app, or something you are, such as a fingerprint or face match. The point of the two-factor rule is that a stolen password alone is not enough. That single control removes the large majority of account takeovers, which is why it is the first thing to turn on for email, banking and any remote access.
Why does MFA fail for email and phone logins?
Four failure patterns cover most real cases. First, SIM swap: the attacker convinces or coerces the carrier to move your number to a new SIM, and the SMS code now lands with them. The UPI and OTP rails in India make this worth attempting. Second, device code and consent phishing: the user types the code into a fake page, or approves a push prompt on a device that has been compromised. Third, adversary-in-the-middle relays, where the attacker proxies the session and captures both factors in real time. Fourth, recovery abuse, where the attacker uses a compromised email or a weak help desk process to add a new factor or reset the account.
Which MFA method should an Indian company choose first?
Rank them. Passkeys bound to a device, using platform biometrics, are the strongest practical option because the credential never travels to the site and cannot be typed into a phishing page. Hardware security keys are stronger still for administrators, and are worth issuing to finance and IT staff who handle payments. Authenticator apps with number-matching are a good second choice and work on most Indian phones without a network dependency. SMS codes are the weakest acceptable option, and they should not be the only factor on email, banking or admin accounts. Whichever you pick, the real decision is where MFA is enforced first: email, identity provider, banking and any remote access, in that order.
How do you stop attackers bypassing MFA through recovery?
Treat recovery as the most privileged login you have, because it usually is. Bind recovery to a second, independent factor: a hardware key, a passkey on a different device, or a manager approval plus a video verification call for high-risk resets. Disable voice-call recovery wherever possible, since a call centre agent can be socially engineered. Do not let a help desk reset a factor based only on an email address, and put a cooling-off period on any new factor added to a high-value account, with a notification to a separate channel. Log every factor change, every recovery request and every refusal, and review that log weekly.
| Method | Strength | Fails when | Best use |
|---|---|---|---|
| Passkey bound to a device | Strongest practical option | The device is compromised or the user is tricked into approving | Email, banking, admin accounts |
| Hardware security key | Strongest, phishing resistant | The key is lost or shared | IT admins, finance sign-off |
| Authenticator app with number matching | Good, offline capable | The seed is phished or the phone is compromised | Staff accounts, VPN access |
| Push approval | Moderate | Relay attack or user approval fatigue | Only with number matching and short windows |
| SMS OTP | Weakest acceptable | SIM swap, SS7 and interception | Low-risk accounts and recovery only |
What are the frequently asked questions?
Get a straight answer on this
Send us your list of critical systems and login types, and we will return a fixed-price MFA hardening plan covering email, banking, admin access and the recovery path.
Send us the details See pricing