MFA Explained: Why Passwords Alone Are No Longer Enough

One thing you know, and nothing else. If that one thing leaks, in a data breach, a phishing email, or just a weak password someone guessed, there's nothing else standing in the way. This isn't MFA at all, it's the starting point everything else improves on.

A password plus a code texted or called to your phone. Better than nothing, but this is also the exact method Microsoft has announced it's retiring starting September 2026, specifically because it's the weakest form of MFA still in common use, vulnerable to SIM-swapping and, as covered below, real-time interception.

Instead of a code, your phone gets a push notification asking "was this you?" Modern versions require number matching, typing a number shown on your screen into the app, specifically to stop people from reflexively tapping "Approve" without looking. This closed one real gap, but a determined attacker can still defeat it, covered in the attack walkthrough below.

No password in the flow at all. You sign in with just your phone, using Microsoft Authenticator's passwordless phone sign-in, and a match on your device (face, fingerprint, or PIN) replaces typing anything. There's no password left for a phishing page to steal in the first place.

A passkey is a cryptographic key pair replacing a password entirely, and it comes in two forms worth knowing apart. A device-bound passkey (like one stored in a FIDO2 key or in Authenticator) never leaves that specific device. A synced passkey is encrypted and synced across your other devices through a provider like your phone's built-in password manager, more convenient, slightly less strict than device-bound.

A physical hardware key, a small USB or NFC device, that proves your identity by proving you physically have that specific object. This is device-bound by definition and is one of the methods that qualifies as genuinely phishing-resistant, for reasons explained in the next section.

The enterprise-grade top of the ladder: biometric or PIN sign-in tied to a hardware-backed key on a specific Windows device, or a certificate issued directly to that person. Alongside FIDO2 keys, this sits in Microsoft's strongest official tier, covered next.

You get a convincing phishing email and click through to a page that looks exactly like your real sign-in page. It isn't. It's a proxy sitting silently between you and the real Microsoft sign-in page.

You type your password into the fake page. The proxy immediately forwards it to the real site, in real time, as if it were you typing it there directly.

The real Microsoft site, thinking it's really you, sends back a real MFA challenge. The proxy relays that challenge straight to your phone. The push notification or text code you receive is completely real, because it genuinely came from Microsoft, just relayed through an attacker sitting in the middle.

You tap "Approve," or type the real code, because everything about the request looks legitimate. It is legitimate, it's just being relayed by someone who shouldn't be there.

The proxy captures the session the real site just granted, and the attacker uses it directly, no password needed again, often within hours, to move on to further attacks like business email compromise.

Microsoft is retiring these methods starting September 2026. If your organisation still leans on text-message codes as the primary MFA method, that removal is a forcing function, better to move deliberately now than scramble when it's gone.

It's a small, real improvement against the laziest version of push-approval fatigue, even though it doesn't stop a genuine AiTM proxy.

Your highest-privilege accounts are the ones worth protecting with the tier that actually stops the attack described above, before rolling anything out more broadly.

Full phishing-resistant hardware keys for every employee is a real cost and logistics project. Passwordless sign-in through Microsoft Authenticator is a meaningfully stronger, more achievable step for most of the organisation in the meantime.