Multi-Factor Authentication: Why SMS Codes Are No Longer Enough
Multi-factor authentication is one of the most effective security controls available. Microsoft's data shows that MFA blocks more than 99% of automated account compromise attacks. But not all MFA is equal, and as MFA adoption has grown, so has attacker sophistication in bypassing it.
This guide explains why SMS codes are no longer sufficient, what genuinely strong MFA looks like, and how to implement it properly.
Why MFA Matters
Before getting to the weaknesses of SMS, it's worth being clear about what MFA achieves and why it's so important.
Traditional password-only authentication is easily defeated. Passwords are stolen through phishing, brute force, credential stuffing (trying credentials from other breaches), keyloggers, and social engineering. The volume of breached credential data available to attackers is vast — billions of username and password combinations are available on criminal marketplaces for trivial cost.
MFA adds a second factor: something you have (a phone, a hardware key), something you are (biometrics), or an additional something you know. Even if an attacker has your username and password, they can't complete authentication without the second factor.
For most attack scenarios, this is decisive. Automated attacks that try stolen credentials can't complete authentication because they don't have the second factor. The difference in protection between password-only and password-plus-MFA is enormous.
The Weaknesses of SMS-Based MFA
SMS codes — where a six-digit code is sent to your mobile number when you log in — have been the most widely deployed form of MFA, and they're meaningful protection against most automated attacks. But they have specific weaknesses that more sophisticated attackers exploit.
SIM swapping is an attack where an attacker contacts your mobile carrier, impersonates you, and convinces them to transfer your number to an attacker-controlled SIM. Once they control your number, they receive your SMS codes. SIM swapping is more common than most people realise, particularly against business owners and executives.
Real-time phishing is increasingly common. A user receives a convincing phishing email, clicks a link, and lands on a fake login page. They enter their credentials. The attacker's system immediately uses those credentials on the real site, which triggers an SMS code. The fake page then asks the user for their code. The user enters it, the attacker has it, and the account is compromised. This bypasses SMS MFA entirely.
Adversary-in-the-middle attacks use proxy servers that sit between the user and the legitimate site, passing traffic back and forth while capturing credentials and session tokens. Tools like Evilginx have made this type of attack straightforward to execute.
These attacks are sophisticated but no longer rare. As MFA adoption has grown, attackers have invested in bypassing it. For businesses protecting valuable data, SMS MFA is no longer a sufficient defence.
What Genuine Strong MFA Looks Like
Authenticator apps are a significant improvement over SMS. Microsoft Authenticator, Google Authenticator, and similar apps generate time-based one-time passwords (TOTP) locally on the device, without any SMS transmission. They're less vulnerable to SIM swapping.
Microsoft Authenticator also supports push notifications with number matching — when you attempt to log in, the app shows you a number that you must match to a number displayed on the login screen. This prevents "MFA fatigue" attacks, where attackers trigger repeated MFA notifications hoping you'll approve one out of frustration.
FIDO2 hardware keys provide the strongest form of MFA currently available. YubiKey and similar hardware tokens use public key cryptography that is phishing-resistant by design. The authentication is cryptographically bound to the specific website domain — a FIDO2 key will not authenticate on a phishing site that mimics the legitimate service, because the domain doesn't match. FIDO2 keys are resistant to all the attack scenarios described above.
Certificate-based authentication (used in some enterprise environments) provides similar phishing-resistance to FIDO2 but requires more complex infrastructure.
Windows Hello for Business and platform authenticators (biometrics on managed devices) are also phishing-resistant and increasingly viable for business deployments.
Implementing Strong MFA Without Disrupting Your Business
The practical challenge of MFA implementation is user acceptance. MFA adds friction, and friction generates pushback. This is the most common reason MFA isn't deployed or is deployed incompletely.
The key is making the right MFA method genuinely low-friction for your users. Microsoft Authenticator with passwordless authentication (no password required; just approve a notification) is often less friction than typing a password. Modern Windows Hello authentication with a fingerprint or face recognition is nearly frictionless.
Conditional Access policies allow you to apply different MFA requirements based on context. Logging in from a trusted device on your corporate network might require no additional authentication. Logging in from an unfamiliar device in an unfamiliar location triggers strong MFA. This reduces friction for normal usage while maintaining strong protection for unusual scenarios.
For most businesses, the right starting point is Microsoft Authenticator with number matching, deployed via Conditional Access. For higher-risk users — executives, admin accounts, anyone with access to sensitive financial or legal data — hardware keys are worth the additional investment.
Start with your highest-risk accounts and work outward. Getting strong MFA on admin accounts and executive accounts immediately reduces your most significant exposure. Then extend to all users systematically.
If you want help designing and implementing an MFA deployment that works for your business without causing operational disruption, get in touch. We've done this for many businesses across West Sussex and can make the process straightforward.