MFA bypass defeats an extra login check by tricking a user, stealing a session, or intercepting a one time code during sign in.
The password may still be wrong or unknown, yet the attacker finishes login because the second check was persuaded, relayed, or skipped.
How it works
Some attempts bombard a person with approval prompts until an annoyed tap accepts one, and others show a fake site that forwards a code in real time.
A further pattern steals the session after a legitimate login, so the second factor already succeeded and the cookie or token is what gets reused.
These are categories of failure, not instructions for building a relay or for taking over a phone account.
Stronger authenticators that bind the login to the real site, plus fewer prompt based approvals, remove the easiest paths without weakening the idea of a second check.
Concrete examples
- An employee approves a push prompt while commuting because several prompts arrived and one seemed like a glitch in an app they use daily.
- A fake payroll page accepts a password and a one time code and immediately uses both on the real payroll site.
- A support tool stores a session token in a log that an attacker later replays without ever seeing the second factor prompt.
Protective measures
- Prefer authenticators that check the site name so a lookalike page cannot silently complete the login.
- Number match or otherwise make approval deliberate, and teach people to deny prompts they did not just start.
- Protect session tokens in logs and in support tools so a finished login cannot be copied from a ticket.
- Watch for many prompts, many failed codes, and new device sign ins that follow a password reset.