Turning on multi-factor authentication is the best security move a small business can make, and you should absolutely do it. But somewhere along the way "we have MFA" became a synonym for "we are safe," and attackers have spent years finding ways around it. The good news is they rarely break MFA; they trick people into helping. Knowing the handful of tricks, and the fixes, turns MFA from a false comfort into the strong defence it is meant to be.
The three ways MFA gets bypassed
Almost every real-world MFA bypass falls into one of three buckets, and none of them involves cracking your second factor:
- Device-code phishing. The attacker starts a legitimate sign-in, shows you a short code, and gets you to enter it at the real Microsoft or Google page. You approve, but you have approved their session, not yours. This is the trick behind the recent hotel Wi-Fi attacks.
- Consent (OAuth) phishing. Instead of your password, you are asked to grant a malicious app permission to your account. Click "allow," and the app has ongoing access, no password or MFA needed again, because you gave it a key.
- Adversary-in-the-middle session theft. A convincing fake login page sits between you and the real one, relays everything including your MFA, and quietly copies the finished session token. We covered a kit that does exactly this in an earlier post.
The common thread
In all three, your password and your MFA worked exactly as designed. What failed was that you were tricked into approving, granting, or completing something for the attacker. That is why the answer is not "MFA is useless," it is "use MFA that resists tricks, and add a few guardrails."
How a small business shuts them down
- Move to phishing-resistant MFA. Passkeys and hardware security keys are bound to the real website, so they simply do not work on a fake page or a relayed session. This is the single biggest upgrade, especially for admins. See our passwords and passkeys guide.
- Never approve what you did not start. If a code, prompt, or consent screen appears that you did not personally initiate, treat it as an attack. Teach the team this one reflex.
- Use Conditional Access. On Microsoft 365 you can restrict the device-code flow, require compliant devices, and limit risky sign-ins, exactly the sign-in hardening that closes these doors.
- Review app permissions. Periodically check which apps have access to your Microsoft 365 or Google accounts and remove ones you do not recognise, that is how you catch consent phishing.