What is MFA?

Not all MFA is equally strong, and the differences matter for how confident you can be in an alert. SMS one-time codes are the weakest common method, vulnerable to SIM swapping (an attacker social-engineers the victim's carrier into porting their number) and to adversary-in-the-middle (AiTM) phishing kits that simply relay the code in real time. Authenticator app TOTP codes (Google Authenticator, Microsoft Authenticator) are a meaningful step up since they don't depend on the phone network, but they're still vulnerable to the same AiTM relay attack, because the code itself can still be captured and replayed within its validity window. FIDO2/WebAuthn hardware keys (YubiKey and similar) are phishing-resistant by design: the cryptographic challenge is bound to the specific origin domain the browser is talking to, so a lookalike phishing site simply cannot produce a valid signed assertion even if the victim tries to authenticate on it. That origin-binding is the structural difference that makes FIDO2 immune to a whole class of attack the other methods aren't. Attackers have adapted their techniques to target MFA directly rather than avoid it: AiTM proxy phishing kits (Evilginx and similar) sit between the victim and the real login page, harvesting the session cookie issued after successful MFA so the attacker never needs the password or code again for that session. MFA fatigue (also called push bombing) spams the victim with repeated approval prompts, sometimes at 2am, until they tap approve just to make it stop, no credential theft required at all, just persistence and annoyance. SIM swapping specifically targets SMS-based MFA by compromising the phone number itself rather than the account.