MFA’s Blind Spot: Authentication vs Real-World Identity
About 70% of enterprise workers use MFA, but attackers exploit enrollment, account recovery, help desks, device registration and session hijacks to access accounts as impostors.
About 70% of enterprise workers now use multi-factor authentication. Attackers are exploiting processes around enrollment, account recovery, help desks, device registration and session handling to pass MFA and access accounts as impostors.
MFA confirms control of authentication factors such as passwords, one-time codes or security keys. It does not by itself prove the real-world identity of the person using those factors. The NIST Digital Identity Guidelines distinguish authentication from identity proofing.
Common attack methods include social engineering of help-desk staff to reset MFA and enroll a new device, SIM swaps to collect one-time codes, enrolling attacker-controlled devices during re-registration, and stealing authenticated sessions. In these scenarios the login meets MFA checks while the account is controlled by an attacker.
The risk continues after successful login. Sessions can be hijacked minutes after sign-in. A compromised account can be used to escalate privileges or access data outside a user’s normal pattern. MFA provides a point-in-time check and does not monitor ongoing behavior unless paired with additional controls that analyze activity and device posture.
Security teams and guidance recommend treating identity confidence as a lifecycle. That includes stronger identity proofing at enrollment, stricter verification during account recovery and device replacement, and use of behavioral signals and device telemetry to monitor activity after sign-in. High-risk actions such as re-enrolling an authenticator, resetting credentials or granting administrative rights can require additional verification.
MFA remains a tool to reduce credential theft and make phishing attacks harder when it uses phishing-resistant factors. MFA does not detect manipulated recovery processes, improperly proofed enrollments or later session hijacking. Organizations combine identity proofing, resilient MFA and continuous identity threat detection to address those separate risks.
Articles by this author
