--- title: The MFA you have isn’t the MFA you think you have description: Compliance reports treat all MFA methods as equivalent, but push notifications and SMS one-time codes remain highly vulnerable to push fatigue attacks, SIM... canonical: https://daily.dev/posts/the-mfa-you-have-isn-t-the-mfa-you-think-you-have-t8uzkevju twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The MFA you have isn’t the MFA you think you have | daily.dev og:description: Compliance reports treat all MFA methods as equivalent, but push notifications and SMS one-time codes remain highly vulnerable to push fatigue attacks, SIM... og:url: https://daily.dev/posts/the-mfa-you-have-isn-t-the-mfa-you-think-you-have-t8uzkevju og:image: https://api.daily.dev/og/posts/t8uZkEVjU.png og:image:alt: The MFA you have isn’t the MFA you think you have og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The MFA you have isn’t the MFA you think you have **[CSO Online](https://daily.dev/sources/csoonline)** · 6 min read · 0 upvotes · 0 comments ## Summary Compliance reports treat all MFA methods as equivalent, but push notifications and SMS one-time codes remain highly vulnerable to push fatigue attacks, SIM swapping, and reverse-proxy phishing kits that intercept codes in real time. Breaches at Uber and MGM Resorts trace back to this gap. FIDO2 and passkeys close it through origin-binding cryptography that makes phishing sites structurally unable to intercept logins, but migration is slowed by legacy system incompatibility, hardware key costs, and user friction. Organizations making progress start with high-risk accounts (admins, identity providers, credential resetters) before expanding to finance and engineering, while setting sunset dates for SMS OTP. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why can push notification MFA still be bypassed by attackers? Push notification MFA can be defeated through push fatigue, also called MFA bombing, where an attacker with a stolen password repeatedly sends approval prompts to a victim's phone until they get annoyed or confused enough to tap approve. This works because the method never verifies that the person approving and the system requesting are talking to the same legitimate destination. _Teams weighing MFA options can track phishing-resistant authentication guidance on daily.dev._ ### Why is SMS one-time code MFA considered weak compared to passkeys? SMS OTP codes can be stolen through SIM swapping, where an attacker convinces a mobile carrier to move a victim's phone number to a device they control, or through reverse-proxy phishing kits that intercept the code in real time as the victim types it into a fake login page that forwards everything to the real site. Passkeys avoid this because there is no code to steal at all. _Anyone hardening account security can follow passkey and phishing-resistant MFA developments on daily.dev._ ### What makes FIDO2 and passkeys resistant to phishing in a way push and OTP are not? FIDO2 and passkeys are resistant because the browser checks the login domain's origin before anything happens, and a cryptographic key pair created at enrollment is permanently locked to that one legitimate website. A lookalike phishing domain simply doesn't match, so the login attempt fails before a user can be tricked into approving it, unlike push or OTP which rely on user vigilance. _Security teams planning a passkey migration can find related authentication guidance through daily.dev._ ## Similar posts on daily.dev - [The Death of Legacy MFA and What Must Rise in Its Place](https://daily.dev/posts/the-death-of-legacy-mfa-and-what-must-rise-in-its-place-spjcupqs9) · Security Boulevard · 0 upvotes · 0 comments - [When attackers already have the keys, MFA is just another door to open](https://daily.dev/posts/when-attackers-already-have-the-keys-mfa-is-just-another-door-to-open-w43ekq8fj) · BleepingComputer · 0 upvotes · 0 comments - [MFA-optional banks leave safe doors \(and accounts\) wide open for thieves to pillage](https://daily.dev/posts/mfa-optional-banks-leave-safe-doors-and-accounts-wide-open-for-thieves-to-pillage-7ajlibdr5) · The Register · 0 upvotes · 0 comments - [PayPal launches latest struggle to get rid of SMS for MFA](https://daily.dev/posts/paypal-launches-latest-struggle-to-get-rid-of-sms-for-mfa-lfvwmn775) · CSO Online · 0 upvotes · 0 comments - [Two-Factor Authentication Breaks Free from the Desktop](https://daily.dev/posts/two-factor-authentication-breaks-free-from-the-desktop-ufoj6gmjt) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#phishing](https://daily.dev/tags/phishing), [#passkeys](https://daily.dev/tags/passkeys) [View this post on daily.dev](https://daily.dev/posts/the-mfa-you-have-isn-t-the-mfa-you-think-you-have-t8uzkevju) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The MFA you have isn’t the MFA you think you have","url":"https://daily.dev/posts/the-mfa-you-have-isn-t-the-mfa-you-think-you-have-t8uzkevju","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-mfa-you-have-isn-t-the-mfa-you-think-you-have-t8uzkevju"},"datePublished":"2026-09-30T10:07:51.646Z","dateModified":"2026-09-30T10:28:31.643Z","description":"Compliance reports treat all MFA methods as equivalent, but push notifications and SMS one-time codes remain highly vulnerable to push fatigue attacks, SIM...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cb035cf97706f19fcd2b8a47d1314e65?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cb035cf97706f19fcd2b8a47d1314e65?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-mfa-you-have-isn-t-the-mfa-you-think-you-have-t8uzkevju","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,phishing,passkeys","timeRequired":"PT6M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"The MFA you have isn’t the MFA you think you have"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-mfa-you-have-isn-t-the-mfa-you-think-you-have-t8uzkevju#faq","mainEntity":[{"@type":"Question","name":"Why can push notification MFA still be bypassed by attackers?","acceptedAnswer":{"@type":"Answer","text":"Push notification MFA can be defeated through push fatigue, also called MFA bombing, where an attacker with a stolen password repeatedly sends approval prompts to a victim's phone until they get annoyed or confused enough to tap approve. This works because the method never verifies that the person approving and the system requesting are talking to the same legitimate destination. Teams weighing MFA options can track phishing-resistant authentication guidance on daily.dev."}},{"@type":"Question","name":"Why is SMS one-time code MFA considered weak compared to passkeys?","acceptedAnswer":{"@type":"Answer","text":"SMS OTP codes can be stolen through SIM swapping, where an attacker convinces a mobile carrier to move a victim's phone number to a device they control, or through reverse-proxy phishing kits that intercept the code in real time as the victim types it into a fake login page that forwards everything to the real site. Passkeys avoid this because there is no code to steal at all. Anyone hardening account security can follow passkey and phishing-resistant MFA developments on daily.dev."}},{"@type":"Question","name":"What makes FIDO2 and passkeys resistant to phishing in a way push and OTP are not?","acceptedAnswer":{"@type":"Answer","text":"FIDO2 and passkeys are resistant because the browser checks the login domain's origin before anything happens, and a cryptographic key pair created at enrollment is permanently locked to that one legitimate website. A lookalike phishing domain simply doesn't match, so the login attempt fails before a user can be tricked into approving it, unlike push or OTP which rely on user vigilance. Security teams planning a passkey migration can find related authentication guidance through daily.dev."}}]} ```