Passwords & MFA Basics — Why Most MFA Isn't Phishing-Resistant

A self-employed Dutch consultant uses the same password for her client-portal account and her personal email. The password was leaked in a 2019 LinkedIn breach she never heard about. In 2026 an attacker takes the leaked credentials, automatically tries them against 200 SaaS providers, gets a hit on her client portal, downloads three years of invoice templates, and emails her clients new wire instructions for outstanding amounts. €91,000 moves before the third client calls her to check. The password was strong (16 characters). It just wasn't unique. Within four hours she had: enabled phishing-resistant MFA on every account, installed a password manager, and rotated 47 passwords. She wished she'd done it the day before.

Two layers of defence matter: the password itself, and the MFA on top of it. **The password layer.** Most attacks against passwords are not 'guessing your password' — they are reusing passwords from prior breaches. Every dump on Have I Been Pwned (haveibeenpwned.com) is a list of credentials being mass-tested against every SaaS the attackers can think of. The fix is a password manager (Bitwarden, 1Password, etc.) generating a unique strong password per account. Length matters more than complexity — a 16-character random string is fine; 'P@ssw0rd!' is not. **The MFA layer.** MFA adds 'something you have' to 'something you know'. But the four common MFA methods have very different security profiles. **SMS codes**: defeats password-only attacks but is relayable in real time by phishing kits and can be stolen via SIM-swap. Better than nothing, worse than every alternative. **TOTP authenticator apps (Google Authenticator, Authy)**: defeats password-only attacks, defeats SIM-swap, but is relayable in real time by reverse-proxy phishing kits like Evilginx. Still better than SMS. **Push notifications (Microsoft Authenticator, Duo)**: same security as TOTP, but adds MFA-fatigue vulnerability where an attacker spams prompts until you tap approve. **FIDO2 / passkeys**: cryptographically bound to the legitimate URL — the attacker's proxy domain doesn't match, so the protocol fails. This is the only method that defeats all the major 2026 attack patterns including AiTM, MFA fatigue, and SIM-swap. The four attack patterns to defend against: password-only (defeated by any MFA), SIM-swap (defeated by anything except SMS), real-time relay / AiTM (defeated only by FIDO2/passkeys), MFA fatigue (defeated by FIDO2 or by removing push prompts).

• Any account you sign into that doesn't have MFA — enable it immediately, especially email, financial, and identity-provider accounts
• Reused passwords across accounts — a single breach compromises every account sharing that password
• SMS-based MFA on high-value accounts (bank, primary email) — upgrade to TOTP or passkeys
• Unsolicited MFA prompts on your phone — someone has your password and is trying to log in
• MFA-fatigue patterns — multiple push prompts in quick succession

1. Install a password manager today — Bitwarden, 1Password, KeePassXC are good starting pointsGenerate a unique 16+ character password per account. The master password is the only one you need to remember.
2. Enable MFA on every account that supports it — start with email and financialYour email is the recovery channel for every other account. Protect it first.
3. Upgrade SMS-based MFA to TOTP or passkeys where supportedMicrosoft, Google, Apple all support passkeys in 2026. So do most banks and major SaaS providers.
4. If you see an unsolicited MFA prompt: reject it, change your password from a clean device, and reportRejection alone isn't enough — the attacker has your password and will try again.
5. Check Have I Been Pwned for every email address you useFree service: haveibeenpwned.com. Rotate any password that appears in a breach.

• NIST SP 800-63B — Authenticator guidance[primary]
• NCSC-NL — Wachtwoorden en MFA[primary]
• FIDO Alliance — Passkeys[primary]
• Have I Been Pwned[secondary]
• Krebs on Security — SIM-swap and MFA bypass case studies[secondary]

• How Attackers Think — The Mindset Behind Every Modern Cyber Attack

  6 min read

• The Five Attack Categories — A Map of What You'll Actually Face

  7 min read

• Microsoft 365 Phishing in 2026 — AiTM, Token Theft, and the End of TOTP

  10 min read