How Attackers Bypass MFA in the Real World

How the Attack Worked

Multifactor authentication is often treated as a near-guarantee of account security, but attackers have developed several real-world techniques to get around it. One method, known as MFA fatigue or push bombing, involves rapidly sending numerous authorization requests, typically via SMS push messages, until a user gives in and approves the request, granting access to an attacker. Attackers often pair this with social engineering, impersonating internal IT or security staff to create a false sense of trust and pressure the target into approving the login.

Other techniques target the authentication channel itself rather than the user's patience. SIM swapping works by convincing a telecom customer service employee that the attacker is the legitimate phone owner, redirecting SMS one-time codes to the attacker's device. Separately, attackers set up phony login pages or use real-time relays and man-in-the-middle proxies to intercept MFA codes as a user types them in. In some cases, attackers skip credentials and codes altogether by stealing session cookies or authentication tokens, since the authorization process has no way of knowing whether the current holder of that token ever legitimately authenticated.

Why It Succeeded

These techniques succeed because they exploit trust and process gaps rather than breaking encryption. A flood of prompts wears down user attention, and a confident, urgent-sounding pretext from someone claiming to be IT reduces scrutiny. Telecom support processes can be manipulated through social engineering rather than technical exploitation. And because many websites don't enforce session inactivity limits, a stolen cookie can grant ongoing access without ever triggering another MFA challenge.

What to Watch For

• Repeated, unexpected MFA prompts that the user did not initiate
• Pressure to approve a prompt quickly to resolve an alleged security issue
• Login pages reached through unusual links, or unexpected re-authentication requests after already being signed in
• Requests to a telecom or IT support line that skip standard identity verification steps

How to Build Resistance

Organizations can reduce exposure by treating unexpected MFA prompts as a likely attack: employees should deny and report them rather than approve them to "make the alerts stop." Reducing reliance on SMS-based codes and strengthening account recovery and SIM-change processes closes off common bypass paths. Enforcing session timeouts and monitoring for cookie or token theft limits how much value an attacker gains from a captured session. Regularly reviewing authentication workflows, including how IT, service desk, and telecom support staff verify identity, helps ensure MFA delivers the protection it's meant to provide.

What is MFA fatigue or push bombing?

MFA fatigue, also called push bombing or prompt bombing, is when an attacker rapidly sends numerous authorization requests until a user gives in and approves one, granting access.

Can attackers bypass MFA even without stealing a password?

Yes. Attackers can intercept session cookies or tokens after a user authenticates, and reuse that session to bypass MFA entirely since the system cannot verify whether the token holder legitimately authenticated.

How does a SIM swap defeat SMS-based MFA?

An attacker convinces a telecom customer service employee that they are the legitimate phone owner, then redirects the victim's number to a new SIM so SMS one-time codes are delivered to the attacker instead.

What should employees do if they get an unexpected MFA prompt?

Treat any MFA prompt they did not initiate as a potential attack, deny it, and report it immediately rather than approving it to make the alerts stop.