Can MFA Fail? Risks Businesses Need to Manage

A stolen password should no longer be enough to open your company’s Microsoft 365 tenant, finance system or cloud files. That is why multi-factor authentication is one of the most valuable security controls a business can deploy. But can MFA fail? Yes. It can be bypassed, misconfigured, unavailable when people need it, or undermined by weak recovery processes.

That does not mean MFA is ineffective. Properly implemented, it dramatically reduces the risk of account takeover. The issue is treating it as a complete security strategy rather than one vital layer in a wider approach to identity, devices and business continuity.

Can MFA Fail in a Real-World Attack?

MFA requires users to prove their identity with more than a password. This might be an authenticator app prompt, a one-time code, a hardware security key, a biometric check or a passkey. The additional check makes opportunistic password attacks far less likely to succeed.

However, attackers have adapted. Most successful MFA bypasses do not involve breaking the underlying technology. They exploit people, processes or the session that has already been authenticated.

A common example is phishing. An employee receives a convincing email that appears to come from Microsoft, a supplier or an internal colleague. They enter their password into a fake sign-in page, then approve an MFA prompt. More advanced phishing sites can act as a proxy between the user and the genuine service, capturing the authenticated session cookie once access has been granted. The criminal may then be able to access the account without needing another prompt.

MFA fatigue is another concern. If an attacker has obtained a password, they may repeatedly trigger login prompts, hoping the user approves one simply to stop the notifications. This is particularly effective when staff are busy, travelling or unsure how to report a suspicious alert.

There are also operational failures. A lost phone, an unavailable mobile network, an incorrectly configured conditional access policy or an over-restrictive security rule can lock legitimate employees out of vital systems. For a business with multiple sites, shift workers or remote teams, that can quickly become a productivity and continuity issue.

Where MFA Is Most Often Let Down

The strength of MFA depends on the method used and the surrounding controls. Text-message codes offer a useful improvement over passwords alone, but they are more vulnerable to SIM-swapping attacks, interception and social engineering than app-based authentication or hardware keys.

Push notifications are convenient, but convenience creates a trade-off. A simple Approve or Deny prompt gives users little context. Number matching, where the employee enters a displayed number into their authenticator app, makes accidental approval harder. It is not invulnerable to phishing, but it raises the bar.

The most phishing-resistant options are generally passkeys and FIDO2 security keys. They are tied to the legitimate website or service, making them far more difficult to use on a fraudulent domain. They may not be the right immediate choice for every user or application, particularly where legacy systems are involved, but they are worth prioritising for administrators, finance teams and anyone with access to sensitive data.

Weak account recovery is another frequent gap. An organisation may enforce strong MFA at sign-in, then allow a caller to reset access after answering easily researched questions or persuading a busy service desk colleague. If recovery is weaker than sign-in, criminals will target recovery.

Legacy authentication can create similar problems. Older email clients, applications and protocols may not support modern MFA. If they remain enabled as exceptions, attackers will look for them. A policy is only as strong as its least protected route into the environment.

MFA Is Not a Substitute for Good Identity Security

A user who has approved a fraudulent login can still cause serious damage if their account has broad access to files, finance platforms or administration tools. MFA should therefore sit alongside controls that limit what an account can do and detect behaviour that does not look right.

Conditional access policies are especially useful here. They can require stronger authentication for high-risk actions, block sign-ins from unusual locations, restrict access from unmanaged devices, or challenge users when their risk profile changes. The aim is not to make work difficult. It is to apply appropriate checks where the potential impact is highest.

Least-privilege access matters too. Staff should have the permissions they need for their role, rather than permanent access to every system or shared folder. Administrator accounts should be separate from everyday email accounts, protected with stronger authentication and used only when required.

Endpoint security also remains essential. If a compromised laptop already has a valid, authenticated session, MFA alone cannot prevent malware, data theft or ransomware. Managed device controls, patching, endpoint detection and a tested backup and recovery plan provide the additional protection needed when identity defences are not enough.

How to Reduce the Chance That MFA Will Fail

For most businesses, the answer is not to replace MFA. It is to make the implementation more deliberate and resilient. Start by reviewing who has MFA, which methods they use and which systems are excluded. Pay particular attention to privileged accounts, shared service accounts, remote access tools and cloud administration portals.

A practical improvement plan should address four areas:

• Use stronger methods for higher-risk users. Move administrators, directors, finance staff and IT support teams towards passkeys or FIDO2 security keys where practical. Use number matching rather than basic push approvals for other users.

• Remove weak routes around MFA. Disable legacy authentication where possible, review application exceptions and prevent personal or unmanaged devices from accessing sensitive systems unless there is a clear business case.

• Tighten recovery and service desk processes. Verify identity carefully before resetting MFA, document escalation routes and ensure no individual can bypass controls without appropriate approval and audit records.

• Prepare people to recognise the attack. Staff should know that unexpected sign-in prompts are a warning, not an inconvenience. Make reporting simple, act quickly on reports and run short, relevant awareness sessions rather than relying on an annual tick-box exercise.

Logging and monitoring complete the picture. Unusual sign-ins, impossible travel, repeated denied prompts, new inbox rules and unexpected changes to MFA details can all indicate account compromise. The value comes from having someone review and respond to those signals, not merely collecting them.

Planning for MFA Outages Without Weakening Security

Every business should consider the awkward question: what happens if several employees cannot access their authenticator app, or the identity provider has an outage? The wrong response is to create a permanent emergency bypass that attackers can exploit.

Instead, establish a controlled break-glass process. Emergency accounts should be tightly restricted, protected with separate strong credentials, monitored closely and used only under documented circumstances. Test the process before an incident, including who can authorise access and how normal controls are restored afterwards.

For frontline or shared-device environments, choose authentication methods that fit the way people actually work. A policy designed solely for office-based staff with personal smartphones may fail in a warehouse, care setting or multi-site operation. Security that people cannot use reliably will eventually be worked around.

T3C Group helps organisations assess identity risk in plain English, strengthen access controls and build practical security processes around their day-to-day operations. The goal is not security for its own sake. It is to protect the systems your people rely on without creating unnecessary friction.

MFA remains one of the best defences against compromised passwords. Treat it as a strong front door, then make sure the side entrances, recovery procedures, devices and monitoring are protected with equal care.