Multi-factor authentication (MFA) requires a second proof of identity beyond the password — a code from an app, a fingerprint, or a hardware key — so a stolen password alone cannot get an attacker into your accounts. It is the single highest-value control a small business can switch on, and also the one attackers have learned to work around: MFA fatigue push bombing, SIM swapping and real-time proxy phishing kits all target the human who approves the second factor, not the factor itself. Verizon's 2025 Data Breach Investigations Report puts stolen credentials in roughly one in five breaches (full report PDF), and MFA is the control that turns most of those stolen passwords into dead weight. This guide covers how MFA works, which methods are strong, and where the weaknesses are in 2026.
TL;DR
- MFA requires two or more proofs of identity: something you know, something you have, something you are.
- Authenticator apps and hardware keys beat SMS codes, which SIM-swap attacks can intercept.
- The attacks that beat MFA go after the person: push bombing, real-time proxy phishing, SIM swap.
- Small business wins: MFA everywhere, authenticator apps over SMS, hardware keys for finance and admin, and phishing simulations to rehearse the approval decision.
- MFA is a necessary layer, not a complete defence.
How MFA works
MFA combines factors from different categories:
- Something you know — a password or PIN.
- Something you have — an authenticator app code, a security key, a smart card.
- Something you are — fingerprint, face or iris.
Two factors from the same category do not count as MFA. A password plus a security question is one factor asked twice, because both answers can be stolen or guessed the same way.
When MFA is on, a correct password triggers the second challenge: a push notification, a six-digit code, or a tap on a USB key. An attacker holding only the password fails. Verizon's 2025 report puts stolen credentials in about 22% of basic web application attacks — MFA is the control that breaks that chain.
The methods, ranked
| Method | Strength | The weakness |
|---|---|---|
| Hardware security keys (FIDO2) | Strongest | Can be lost; needs a spare |
| Authenticator apps (TOTP) | Strong | Codes phishable by real-time proxy kits |
| Number matching / push with number matching | Strong | Users may still approve out of habit |
| Plain push notifications | Moderate | MFA fatigue attacks spam approvals |
| SMS codes | Weakest | SIM swap and port-out attacks intercept them |
| Email as a second factor | Very weak | The mailbox is often the first thing attackers own |
Three practical rules fall out of that ranking:
- Anything beats nothing. Even SMS MFA stops the majority of automated account takeover.
- Apps beat SMS. Codes generated on-device never touch the phone network, so a stolen phone number cannot intercept them.
- Keys beat everything. Hardware keys are bound to the real site's domain, so a proxy phishing page cannot use them. Give finance and admin staff keys first.
Where MFA fails in 2026
| Attack | How it defeats MFA | The counter |
|---|---|---|
| MFA fatigue / push bombing | Spam push approvals until someone taps accept | Number matching, rate limits, MFA fatigue training |
| Real-time proxy phishing (AiTM) | Relays credentials and MFA approval in one session, steals session cookie | FIDO2 keys, conditional access, device binding |
| SIM swap | Moves the phone number, intercepts SMS codes | Authenticator apps or keys; telco port-out PIN |
| OAuth consent phishing | User grants a malicious app access — no password involved | Restrict third-party app consents; train the review habit |
| Helpdesk social engineering | Attacker talks support into resetting MFA | Verify identity out-of-band; log and review resets |
The shared pattern: every one of these attacks targets the approval moment, not the authentication system. That is why training matters — a staff member who rehearses the decision (phishing simulations) is far less likely to approve a prompt they did not initiate.
What a small business should switch on
- MFA everywhere. Email, finance, CRM, remote access, admin portals — every account without it is the cheapest way in.
- Authenticator apps as the default. Move staff off SMS as part of rollout; ask telcos for port-out PINs in the meantime.
- Hardware keys for high-value accounts. Finance, directors, IT admins.
- Number matching on push. Stops blind approvals; free in Microsoft Entra and Google Workspace.
- Conditional access where available. Require managed devices or block risky sign-ins before MFA even fires.
- Alert on MFA method changes. An attacker who beats one account often changes its MFA to lock you out — that change is your alarm bell.
- Break-glass accounts. Two admin accounts with long random passwords and hardware keys, used only in emergencies, excluded from conditional access — so a policy mistake cannot lock everyone out.
If you are unsure how much of this is already in place, a gap assessment ranks the gaps instead of guessing.
FAQ
What is multi-factor authentication in simple terms? A login that requires a second proof of identity beyond the password — usually a code from an app, a fingerprint, or a hardware security key — so a stolen password alone cannot get in.
Why is MFA important for small business? Because most breaches start with a stolen password, and MFA makes a stolen password alone useless. It is the highest-value, lowest-cost control a small business can enable.
Can MFA be hacked? The system itself rarely is. Attacks target the human approval: push bombing, real-time proxy phishing and SIM swapping. Number matching, hardware keys and trained staff close most of those paths.
Is SMS MFA good enough? It is far better than no MFA, and it stops most automated attacks. But it is the weakest method — SIM swap attacks intercept it. Move to authenticator apps where you can, and hardware keys for finance and admin.
What happens if a staff member loses their phone? Recovery needs planning: backup codes stored securely, a spare hardware key for critical accounts, and an admin process to re-enrol a replacement device. Budget the recovery process before you need it.
Does MFA stop phishing? Not on its own. Real-time proxy kits can relay an MFA approval in real time. MFA raises the bar, but the complete answer pairs it with awareness training so the approval is questioned, not reflexive.
One last thing
Run the coverage check this week: list every system that holds client or financial data, and mark which ones have MFA on every account. The unmarked systems are where the next incident starts — and turning MFA on takes minutes, not a project.