I get this question more and more from business owners: “We turned on MFA… and we’re still hearing about companies getting hacked. Is it even worth it anymore?”
Short answer: yes. Absolutely. Long answer: it depends on which MFA you’re using — and that’s where a lot of businesses are getting caught.
The numbers haven’t changed
Microsoft studied this across millions of accounts. Turning on MFA reduced the risk of an account being compromised by more than 99% — and that held up even for accounts whose passwords had already leaked.
Think about that. The vast majority of attacks are still somebody trying a stolen or guessed password. MFA shuts that door. If you don’t have MFA on your email today, you are the easiest target on the block. Stop reading and go turn it on.
So why are MFA-protected accounts still getting hacked?
Because the bad guys adapted. There are three tricks I see over and over:
- MFA fatigue (“prompt bombing”). The attacker already has your password, so they hammer your phone with approval requests — at 2 a.m., twenty times in a row — until somebody taps Approve just to make it stop.
- Fake login pages that steal the session. You click a link, land on a page that looks exactly like the Microsoft 365 login, enter your password, approve your MFA… and the attacker’s site passes it all through to the real Microsoft and keeps the “you’re logged in” token. Now they’re in your mailbox, no password or MFA needed. This is called adversary-in-the-middle (AiTM) phishing, and it’s the big one right now.
- SIM swapping. If your MFA code comes by text message, someone who talks your cell carrier into moving your number to their phone gets your codes too.
None of these mean MFA “failed.” They mean the weaker forms of MFA are being targeted.
Not all MFA is created equal
Here’s how I rank it for my clients, from worst to best:
- Text message (SMS) or phone call codes — better than nothing, but the weakest option.
- Push notifications that just say “Approve / Deny” — easy to fatigue-bomb.
- Authenticator app with number matching — you have to type the number shown on the login screen. This kills most prompt bombing. Microsoft Authenticator does this now.
- Passkeys and security keys (FIDO2) — these are phishing-resistant. The key checks the real website address, so a fake login page simply doesn’t work. This is where the industry, and CISA, is pushing everyone.
What I tell business owners to do
- Turn MFA on everywhere — email, banking, payroll, remote access, your accounting software. No exceptions for the boss.
- Get off text-message codes wherever you have a better option.
- Use number matching in your authenticator app.
- Give your owners, finance people and IT admins passkeys or security keys. Those are the accounts attackers want most.
- If you’re on Microsoft 365, use Conditional Access (it comes with Business Premium) to block sign-ins from places and devices that don’t make sense, and to limit how long a stolen session is good for.
- Teach one simple rule: an MFA prompt you didn’t start is an attack in progress. Deny it, and call your IT people.
Bottom line
MFA isn’t dead. Lazy MFA is. If your setup is “we turned on text codes in 2020,” you’re overdue for a checkup.
Not sure where your business stands? That’s exactly what our free HTS Technology Assessment is for.
— Jeff