11 Feb The MFA Level-Up
Multi‑Factor Authentication (MFA) is still essential, but not all MFA methods offer the same level of protection. SMS codes are better than passwords alone, but they can be intercepted, phished, or stolen through SIM‑swap attacks. Attackers can exploit weaknesses in mobile networks or trick phone providers into redirecting messages.
To reduce these risks, organisations should move to phishing‑resistant MFA. Technologies like FIDO2 passkeys use strong cryptography tied to a specific device and website, so credentials can’t be reused or stolen through fake login pages. This passwordless approach removes user error from the login process and forces attackers to target the device itself, which is much harder to compromise.
Implementing Hardware Security Keys
Perhaps one of the strongest phishing-resistant authentication solutions involves hardware security keys. Hardware security keys are physical devices resembling a USB drive, which can be plugged into a computer or tapped against a mobile device. To log in, you simply insert the key into the computer or touch a button, and the key performs a cryptographic handshake with the service. This method is quite secure since there are no codes to type, and attackers can’t steal your key over the internet. Unless they physically steal the key from you, they cannot access your account.
Mobile Authentication Apps and Push Notifications
If physical keys are not feasible for your business, mobile authenticator apps such as Microsoft or Google Authenticator are a step up from SMS MFA. These apps generate codes locally on the device, eliminating the risk of SIM swapping or SMS interception since the codes are not sent over a cellular network. Simple push notifications also carry risks. For example, attackers may flood a user’s phone with repeated login approval requests, causing “MFA fatigue,” where a frustrated or confused user taps “approve” just to stop the notifications. Modern authenticator apps address this with “number matching,” requiring the user to enter a number shown on their login screen into the app. This ensures the person approving the login is physically present at their computer.
Passkeys: The Future of Authentication
With passwords being routinely compromised, modern systems are embracing passkeys, which are digital credentials stored on a device and protected by biometrics such as fingerprint or Face ID. Passkeys are phishing-resistant and can be synchronised across your ecosystem, such as iCloud Keychain or Google Password Manager. They offer the security of a hardware key with the convenience of a device that you already carry. Passkeys reduce the workload for IT support, as there are no passwords to store, reset, or manage. They simplify the user experience while strengthening security.
Balancing Security With User Experience
Moving away from SMS-based MFA requires a cultural shift. Since users are already used to the universality and convenience of text messages, the introduction of physical keys and authenticator apps can trigger resistance. It’s important to explain the reasoning behind the change, highlighting the realities of SIM-swapping attacks and the value of the protected information. When users understand the risks, they are more likely to embrace the new measures. While a phased rollout can help ease the transition for the general user base, phishing-resistant MFA should be mandatory for privileged accounts. Administrators and executives must not rely on SMS-based MFA.
The Costs of Inaction
Sticking with legacy MFA techniques is a ticking time bomb that gives a false sense of security. While it may satisfy compliance requirements, it leaves systems vulnerable to attacks and breaches, which can be both costly and embarrassing. Upgrading your authentication methods offers one of the highest returns on investment in cybersecurity. The cost of hardware keys or management software is minimal compared to the expense of incident response and data recovery. Is your business ready to move beyond passwords and text codes? We specialise in deploying modern identity solutions that keep your data safe without frustrating your team. Reach out, and we’ll help you implement a secure and user-friendly authentication strategy.
Robert Brown
11/2/2026
Related Articles:
How AI Is Changing Cybercrime
Stable Connection Is Essential for Your Business