A paralegal at a 30-person law firm in downtown Montréal gets a Teams message that looks like it's from IT: "Your Microsoft 365 session expires today, please sign in again." The sign-in page is pixel-perfect. She enters her password, then the six-digit code texted to her phone. Behind the scenes, the fake page passes everything to the real Microsoft login in real time. The attacker walks away with her live session.
A month earlier, at an Ottawa marketing agency, an account manager was woken up by a stream of "Approve sign-in?" prompts for the company's remote access tool. After the twelfth one, half asleep, he tapped Approve to make them stop.
Both companies had "turned on MFA." Neither was protected. Not all multi-factor authentication is equal, and the method you choose matters more than ever.
TL;DR
- Any MFA beats a password alone, but SMS codes, authenticator codes and simple push prompts can all be bypassed.
- Phishing-resistant MFA (FIDO2 security keys, passkeys, Windows Hello for Business) is tied to the real website, so a fake page can't relay it.
- Start with admins and finance, remove weak fallback methods, then roll it out to everyone.
How attackers get around MFA
Traditional MFA does a great job against stolen passwords on their own. Attackers have adapted.
Real-time relay. This is the adversary-in-the-middle (AitM) technique. A phishing kit shows a copy of the sign-in page and forwards every input to the real site, including your one-time code. The attacker captures the session token, which keeps working without another code. The Canadian Centre for Cyber Security reports detecting more than 100 such campaigns targeting Microsoft Entra ID accounts between 2023 and early 2025.
Push fatigue. An attacker who already has the password triggers approval prompts over and over, often late at night, until the victim gives in out of frustration or habit.
SIM swapping. By talking a carrier into moving your number to a new SIM card, a fraudster starts receiving your text message codes.
The side door. Strong MFA is pointless if SMS is still allowed as a backup method, or if your help desk resets MFA for anyone who calls sounding stressed before a big meeting.
Comparing MFA methods, from weakest to strongest
| Method | Phishing-resistant? | Main weakness | Verdict |
|---|---|---|---|
| SMS or voice call code | No | SIM swapping, code relayed by a fake page | Stopgap only |
| Email code | No | If the mailbox is compromised, the attacker has both factors | Avoid |
| Authenticator app code (TOTP) | No | Code relayed by a fake page | Better than SMS |
| Simple "Approve / Deny" push | No | Fatigue, approving by reflex | Replace it |
| Push with number matching | No | Real-time relay still works | Good baseline for all |
| FIDO2 security key | Yes | Must be carried; needs a backup key | Ideal for admins |
| Passkey | Yes | Only as secure as the device or account that syncs it | Excellent for everyone |
| Windows Hello for Business | Yes | Tied to a managed Windows device | Excellent in the office |
Number matching deserves a word. The user has to type the number shown on the sign-in screen into the app, which kills reflex approvals. Microsoft now applies it to all Authenticator push notifications. But if the user is on a fake page that's relaying the sign-in, they'll see the right number and approve anyway.
Why FIDO2 and passkeys stop phishing
A FIDO2 key or passkey doesn't rely on a code you type. It uses a cryptographic key pair: the private key never leaves the device, and the website only stores the public key.
Crucially, the credential is bound to the real website's domain. If our paralegal lands on a lookalike page at a slightly different address, her browser simply won't offer the passkey. There's nothing to type, so there's nothing to steal or relay.
There are two flavours. Synced passkeys are stored in Apple's or Google's keychain or in a password manager, and follow the user across devices. Device-bound passkeys, such as those on a hardware key, never leave that one device. They're the strictest option and the one to use for admin accounts.
The Canadian Centre for Cyber Security is blunt: organizations should deploy phishing-resistant MFA to every user, without exception, starting with administrators, whose weaker fallback methods should be removed.
Where a small business should start
You don't have to switch everything over in one weekend. Go in order of risk:
- Administrators: Microsoft 365 or Google Workspace, firewall, backup console and your domain registrar. Two FIDO2 keys per person; a hardware key costs a few tens of dollars.
- Finance, payroll and leadership: the prime targets of business email compromise and CEO fraud. Use passkeys or security keys.
- Remote access: VPN and Remote Desktop are classic entry points in a ransomware attack. Hold them to the same standard.
- Everyone else: at minimum an authenticator app with number matching, then a gradual move to passkeys.
Before the company-wide switch, run a two-week pilot with a handful of volunteers, ideally including your least tech-savvy colleague. You'll find the snags early: an older laptop without a fingerprint reader, a shared warehouse workstation, a field technician who works with gloves on. Then sell the change on convenience as much as security. Once set up, signing in with a fingerprint or a key tap is faster than typing a password and waiting for a text.
Cyber insurance applications also tend to ask pointed questions about MFA, especially for remote access and admin accounts. Our guide to cyber insurance questionnaire requirements covers what underwriters look for.
Checklist: the gaps that quietly undo your MFA
- No forgotten "temporary" exclusions (the CEO's account, a service account, the front desk mailbox)
- Legacy sign-in protocols that can't prompt for a second factor are blocked
- SMS is no longer offered as a fallback on accounts protected by a key or passkey
- Help desk MFA resets require strong identity checks (callback to a known number, video or in person)
- Shared mailboxes (info@, billing@) can't be signed in to directly, or have their own MFA
- Two emergency "break-glass" accounts exist, protected by keys stored somewhere safe
- Alerts fire when a new MFA method is registered or a sign-in comes from an unusual country
You can check all of these in the admin console, and several are covered in our Microsoft 365 security audit guide. Our Microsoft 365 and Google Workspace audit reviews them one by one and hands you a realistic migration plan.
The bottom line
MFA isn't an on/off switch. It's a range of methods, some of which stop today's attacks and some of which only stopped yesterday's.
For a small business, the path is straightforward: security keys for admins now, number matching as the floor for everyone, and passkeys as the destination. Each step closes a door attackers are already using.
Frequently asked questions
Do passkeys work with Microsoft 365 and Google Workspace?+
Yes. Microsoft Entra ID, which handles Microsoft 365 sign-ins, supports FIDO2 security keys and passkeys, including passkeys stored in the Microsoft Authenticator app. Google Workspace supports passkey sign-in and lets admins require security keys for specific accounts. In both cases, an administrator has to enable these methods in the admin console first.
What happens if an employee loses their security key?+
Disable the lost key in the admin console right away, then have the employee use their backup key. That's why you issue two keys per person, with one kept somewhere safe. If there's no backup, a temporary access code, such as Microsoft's Temporary Access Pass, lets them register a new key without falling back to SMS.
Can we require employees to use their personal phones for MFA?+
That's primarily an HR and workplace policy question, and some employees will refuse to install work apps on their own devices. Issuing company-owned hardware security keys sidesteps the issue and offers stronger protection. Check your policy with legal or HR advisors.