Two-factor authentication is one of the few pieces of security advice that nearly every expert agrees on, and for good reason: it closes off the single most common way accounts get taken over, which is a stolen or reused password. But "adds a second factor" is not the same as "cannot be defeated," and the gap between those two ideas has widened as attackers have built increasingly sophisticated tools specifically designed around 2FA. Understanding where 2FA genuinely holds up, where it quietly fails, and which methods are worth the small extra friction is the difference between a security habit that actually protects an account and one that offers a false sense of safety.
What Two-Factor Authentication Actually Blocks
At its core, two-factor authentication requires a login to combine something a user knows, like a password, with something a user has or is, such as a phone, a hardware key, or a fingerprint, so that a stolen password alone is no longer enough to access an account.
This directly neutralizes the single largest driver of account takeovers industry-wide: credential stuffing, where passwords leaked from one breached website are automatically tried against many other services, since even a correctly guessed password fails without the second factor.
For the overwhelming majority of everyday attacks, which are automated, untargeted, and run at massive scale against millions of accounts at once, any form of 2FA is enough to stop the attempt cold, which is why it remains foundational advice despite its known limitations.
SMS Codes and the SIM-Swapping Problem
Sending a one-time code by text message was the first widely deployed form of 2FA, and it remains common because it requires no app installation, but it depends entirely on the security of the phone number itself rather than a device or credential the user directly controls.
SIM swapping exploits this dependency: an attacker gathers enough personal details about a victim to convince a mobile carrier's support staff to transfer the victim's phone number onto a SIM card the attacker controls, after which every SMS code silently arrives on the attacker's device instead.
This attack doesn't require breaching any technology at all β it targets the human process carriers use to verify account ownership, which is why security teams increasingly treat a phone number as a weak identity anchor rather than a secure one.
SS7 Network Flaws: Intercepting SMS Without Touching the Phone
Beyond SIM swapping, the telecom signaling protocol that routes calls and texts between carriers worldwide, known as SS7, has long-documented vulnerabilities that let a sufficiently resourced attacker intercept text messages in transit without ever contacting the victim's carrier or phone.
Exploiting SS7 requires specialized access that isn't available to casual attackers, so it has mostly been associated with well-resourced or state-linked actors targeting specific high-value individuals rather than everyday criminals running bulk attacks.
Even though it's a narrower threat than SIM swapping in practice, its existence is a structural reason security researchers describe SMS as an inherently weaker channel than app-based or hardware-based methods, regardless of how carefully an individual account is otherwise secured.
Real-Time Phishing Kits That Steal Codes as You Type Them
Modern phishing has moved well past static fake login pages that simply harvest a password; adversary-in-the-middle kits, popularized by open-source tools such as Evilginx, run a real-time reverse proxy that sits between the victim and the genuine website during login.
When a victim types their password and their one-time code into what looks like a normal login page, the proxy silently forwards those exact values to the real site in real time, and then captures the resulting authenticated session β completing the login as the attacker, not the victim.
Because this happens within the same few seconds as a legitimate login attempt, it defeats SMS codes, authenticator app codes, and even push-approval prompts, since all of these ultimately rely on a human confirming something on a page that could be the attacker's fake site.
Why a Human-Typed Code Can Always Be Phished
The fundamental weakness shared by SMS, authenticator apps, and even push notifications is that all three ultimately hand a piece of information or approval to a human being, who has no reliable way to verify that the site asking for it is the genuine one rather than a convincing lookalike.
An OTP code is just a string of digits; once generated, it works wherever it's entered within its short validity window, which means a phishing site can relay it to the real service just as easily as the legitimate site could use it.
This is a structural limitation, not a matter of user carelessness β no amount of vigilance fully closes the gap, because the code itself carries no information about which website it's being used on.
Origin Binding: Why Hardware Keys and Passkeys Resist Phishing
Hardware security keys and passkeys built on the FIDO2 and WebAuthn standards solve this problem structurally rather than relying on user judgment: during setup, the key cryptographically binds itself to the exact domain name of the website being registered.
When a login attempt happens, the browser and key automatically check that the requesting domain matches the one stored during setup, and if a phishing site is using a lookalike domain, the key simply refuses to respond, regardless of how convincing the fake page looks to a human.
This property, called origin binding, is what separates phishing-resistant authentication from every method described above β it removes the human from the decision entirely, so there's no version of "please copy this code" or "please approve this prompt" for an attacker to social-engineer around.
MFA Fatigue and Prompt-Bombing Attacks
Push-notification-based 2FA, where a user simply taps "approve" on their phone instead of typing a code, is more convenient than SMS or TOTP but introduces its own distinct weakness once an attacker already has a valid password.
In an MFA fatigue attack, also called prompt bombing, the attacker repeatedly triggers login attempts, sending a flood of approval requests to the victim's phone, often at inconvenient times like the middle of the night, hoping the victim eventually taps approve simply to make the notifications stop.
Several high-profile corporate breaches have been publicly attributed to exactly this technique, which is why some platforms now require entering a number displayed on the login screen into the app, adding a small verification step that a purely reflexive tap can't satisfy.
Authenticator Apps (TOTP) vs. SMS: A Meaningful Security Gap
Authenticator apps generate a time-based one-time password (TOTP) locally on the device using a secret key established during setup, meaning no code ever travels over a carrier's network and there's nothing for a SIM swap or SS7 attack to intercept.
This closes off an entire category of attack that SMS remains exposed to, which is why security guidance consistently ranks authenticator apps as meaningfully stronger than text-message codes, even though both ultimately produce a short numeric code a human types in.
The residual weakness is the same one that affects every typed code: a real-time adversary-in-the-middle phishing page can still relay a TOTP code the instant it's entered, so the gap it closes is specifically the network-interception category of attack, not phishing itself.
Backup Codes and the Account-Recovery Weak Link
Nearly every service that offers 2FA also offers a recovery path for when a user loses their phone or hardware key, typically a set of one-time backup codes generated at setup or a support-driven identity verification process.
These recovery paths are frequently the softest target in the entire system, since backup codes stored carelessly, such as in an unencrypted note or a screenshot in a photo library, can be found by anyone with device or cloud-account access, bypassing the 2FA method entirely.
Account-recovery social engineering, where an attacker contacts a company's support team pretending to be a locked-out user, has repeatedly proven effective against services with weak identity-verification steps, since it targets a human process rather than the cryptography of the second factor itself.
Session Token Theft: Bypassing 2FA After the Fact
Even a perfectly executed 2FA login can be undermined after the fact, because a successful login generates a session token or cookie that keeps a user signed in without repeating the login process on every page.
Malware that steals these session tokens directly from a browser, or an adversary-in-the-middle phishing kit that captures the token generated immediately after a victim completes a real login, allows an attacker to load the stolen token into their own browser and access the account without ever needing the password or 2FA code again.
This is why security teams increasingly pair 2FA with session-monitoring measures, such as flagging logins from unfamiliar devices or locations and limiting how long a session token remains valid, since 2FA alone protects the login moment but not necessarily everything that follows it.
Why 2FA Still Stops the Overwhelming Majority of Attacks
The attacks described so far β SIM swapping, SS7 interception, adversary-in-the-middle phishing, MFA fatigue β all require meaningfully more effort, targeting, and sometimes real-time interaction than the automated, opportunistic attacks that make up the vast bulk of everyday account compromise attempts.
Automated credential-stuffing bots, which try leaked username-password pairs against login pages at massive scale, have no mechanism to intercept a text message, relay a phishing session in real time, or spam a push notification β they simply fail the moment a second factor is required.
This is the core nuance often lost in headlines about 2FA bypasses: the described attacks are real and effective against specifically targeted victims, but they represent a tiny fraction of overall attack volume compared to the credential-stuffing and reuse attacks that any 2FA method reliably stops.
What Google and Microsoft Have Reported About 2FA Effectiveness
Large platform providers with visibility into billions of login attempts have repeatedly published research indicating that enabling any additional authentication factor blocks the vast majority of automated, bulk account-takeover attempts, even when that factor is a comparatively weak method like SMS.
Microsoft's security researchers have specifically highlighted that accounts with any form of multi-factor authentication enabled are dramatically less likely to be compromised than accounts relying on a password alone, framing the choice of specific 2FA method as a secondary optimization after the more important step of turning on some form of it at all.
Google's own security teams have described similar findings from studies of account-recovery flows and phishing simulations, consistently pointing toward device-based prompts and hardware keys as stronger than SMS while still finding that SMS meaningfully outperforms no second factor whatsoever.
The Shift Toward Passkeys as a Phishing-Resistant Successor
Passkeys are a newer authentication standard, built on the same FIDO2/WebAuthn cryptography as hardware security keys, that aim to replace passwords entirely rather than simply supplementing them, storing a cryptographic key pair on a device or synced securely across a user's devices via their operating system or password manager.
Because a passkey login is origin-bound in the same way a hardware key is, it inherits the same phishing resistance β there is no password to steal and no code to relay, which eliminates the entire category of adversary-in-the-middle attacks described earlier in one step.
Major platforms, including Google, Microsoft, and Apple, have been actively rolling out passkey support across consumer accounts, reflecting an industry-wide bet that origin-bound, passwordless authentication is the most realistic long-term fix for the phishing weaknesses inherent to typed codes.
Ranking 2FA Methods From Weakest to Strongest
Security guidance now converges on a fairly consistent hierarchy: SMS-based codes sit at the bottom due to SIM-swapping and SS7 exposure, followed by app-based TOTP codes, which close the network-interception gap but remain phishable in real time.
Push notifications sit above basic TOTP when they include number-matching verification, since that added step meaningfully reduces MFA fatigue risk, though they remain vulnerable to sufficiently persistent prompt-bombing and to adversary-in-the-middle relay in some implementations.
Hardware security keys and passkeys sit clearly at the top of this hierarchy, since origin binding removes the human-judgment weak point shared by every other method on the list, making them the only widely available option genuinely resistant to real-time phishing.
Real-World Campaigns That Exploited 2FA's Blind Spots
Security researchers and incident responders have documented numerous campaigns over the past several years that specifically targeted organizations using large-scale adversary-in-the-middle phishing infrastructure, sending convincing login-page lookalikes to thousands of employees at once and harvesting sessions from anyone who completed the flow.
Separately, a wave of publicly reported corporate intrusions has been traced back to MFA fatigue tactics, where attackers who had already obtained employee passwords through unrelated means simply exhausted victims with repeated approval prompts until one was accepted.
These incidents share a common thread: none of them defeated the cryptography of 2FA itself, they defeated the human decision layered on top of it, which is precisely the vulnerability that origin-bound hardware authentication is designed to eliminate.
How to Recognize a Live Phishing or Prompt-Bombing Attempt
A login page that appears immediately after clicking a link in an unexpected email or message, especially one urging urgency around a security alert or account suspension, is the classic setup for an adversary-in-the-middle phishing attempt and deserves a manual check of the URL before entering anything.
A sudden flood of push-approval prompts a user did not initiate is not a technical glitch β it should be treated as a strong signal that someone else already has the account's password and is attempting to complete the login, warranting an immediate password change rather than a reflexive tap.
In both cases, the safest response is to navigate to the service directly by typing its address rather than clicking any link, since that sidesteps the entire lookalike-domain mechanism these attacks depend on.
The Enterprise and Security-Team Perspective
Organizations securing large numbers of employee accounts increasingly treat 2FA method choice as a risk-management decision rather than a simple checkbox, often mandating hardware keys or passkeys for administrators and other high-value targets while allowing weaker methods for lower-risk accounts.
Security teams also deploy conditional access policies that evaluate signals like device health, login location, and network reputation alongside the 2FA result itself, so that even a successfully completed second factor can be challenged further if the surrounding context looks unusual.
This layered, risk-based approach reflects a broader industry shift away from treating 2FA as a single binary gate and toward treating it as one signal among several that together determine whether a login should be trusted.
Layered Defenses Beyond 2FA
Because no single control, including 2FA, can eliminate account-takeover risk entirely, security teams pair it with complementary measures: email filtering and domain-monitoring to catch phishing infrastructure before it reaches users, endpoint protection to detect session-token-stealing malware, and security awareness training focused specifically on real-time phishing and prompt-bombing patterns.
Shortening how long a session token remains valid, and re-prompting for authentication on sensitive actions rather than only at initial login, reduces the value of a single stolen session and limits how much damage results from any one successful bypass.
None of these measures individually replace 2FA β they exist specifically to cover the gaps described throughout this article, forming a defense that degrades gracefully rather than collapsing entirely if any one layer is defeated.
Choosing the Right 2FA Method for Your Own Accounts
For most people, the practical guidance is straightforward: enable a hardware security key or passkey wherever it's offered, especially for email and financial accounts, since compromising email often gives an attacker a path to reset passwords everywhere else.
Where hardware keys aren't supported, an authenticator app is a meaningfully better choice than SMS, and where only push notifications are available, choosing a service that requires number-matching adds a real layer of protection against prompt bombing.
SMS-based 2FA, despite its weaknesses, is still dramatically better than having no second factor at all, so the right takeaway isn't to distrust 2FA broadly but to upgrade to the strongest method available for each account, starting with the ones that matter most.
Two-factor authentication isn't foolproof, and treating it as an unbreakable shield misses exactly the kind of targeted, real-time attacks that have grown around it over the past several years. But the honest picture is more reassuring than alarming: the methods that fail are the ones relying on a human to relay a code or tap approve, while origin-bound methods like hardware keys and passkeys close that gap structurally, and even the weakest form of 2FA still blocks the overwhelming majority of the automated attacks most accounts actually face. The practical lesson isn't to abandon 2FA β it's to climb the ladder from SMS toward phishing-resistant methods wherever they're available, and to stay alert to the specific signs, like unsolicited prompts or urgent login pages, that mark the narrower set of attacks 2FA alone can't stop.
Sources
- Cybersecurity and Infrastructure Security Agency (CISA) β U.S. government guidance on multi-factor authentication and phishing-resistant methods.
- NIST Special Publication 800-63B β Federal digital identity guidelines covering authenticator assurance levels and second-factor security requirements.
- FIDO Alliance β Industry body maintaining the FIDO2 and WebAuthn standards behind hardware security keys and passkeys.
- Google Safety and Security Blog β Google's published research on account-recovery, phishing simulations, and authentication method effectiveness.
- Microsoft Security Blog β Microsoft's research and incident findings on multi-factor authentication effectiveness and MFA fatigue attacks.
FAQ
Does two-factor authentication stop every kind of account takeover?
No. It stops the overwhelming majority of automated, bulk attacks such as credential stuffing, but a determined attacker using real-time phishing kits or SIM swapping can still bypass certain 2FA methods, especially SMS and OTP codes.
Why is SMS-based 2FA considered the weakest option?
SMS codes can be intercepted through SIM-swapping attacks, where an attacker convinces a carrier to move a victim's number to a new SIM, or through SS7 network vulnerabilities that let attackers reroute text messages without ever touching the victim's phone.
What makes hardware security keys phishing-resistant?
FIDO2 and WebAuthn-based keys cryptographically bind a login to the exact website domain requesting it, so even if a user is tricked onto a fake look-alike site, the key simply refuses to respond, unlike a typed code that a human can be fooled into entering anywhere.
What is MFA fatigue or prompt bombing?
It's an attack where someone who already has a victim's password repeatedly triggers push-notification login prompts, hoping the victim eventually taps approve out of annoyance or confusion rather than realizing they are approving an attacker's login attempt.
Should people still enable 2FA despite these weaknesses?
Yes. Major platforms have reported that enabling any form of 2FA blocks the vast majority of automated account-takeover attempts, and even phishable methods like SMS are far safer than a password alone.
What is the strongest form of two-factor authentication available today?
Hardware security keys and passkeys built on the FIDO2/WebAuthn standard are currently considered the strongest and most phishing-resistant options, followed by authenticator apps, then push notifications, with SMS as the weakest widely available method.
About the Author
We reference CISA's multi-factor authentication guidance, NIST Special Publication 800-63B, the FIDO Alliance, the Google Safety and Security Blog, and the Microsoft Security Blog to explain the background and current understanding of this topic.
Loved This Article?
Share it on WhatsApp β Share it on WhatsApp
Get more guides in your inbox β Subscribe to our newsletter for weekly surprising stories from Egypt, Saudi Arabia, Dubai, and beyond.