Skip to content
Cyber Unboxed
Security Basics

MFA: The Second Lock That Hackers Can Still Pick

Multi-factor authentication blocks most stolen-password attacks — but not all of them. Here is how attackers get around it, and what actually holds up.

3 min readBeginner Aug 7, 2026

Explain Like I'm Not a Hacker

MFA is like a guard who checks a second ID after your password. It stops strangers cold — but it can still be fooled if you hand that ID to someone pretending to be the guard.

The 30-second explanation

A password alone is a single lock. MFA adds a second lock. Attackers cannot always pick that second lock, so they try to get you to open it for them, or they steal the key card after you have already walked in.

How it works

  1. 1

    1. You

    Open a link and see a convincing sign-in page.

  2. 2

    2. Fake page

    Forwards what you type to the real service.

  3. 3

    3. Real service

    Asks for your code, then issues a session.

  4. 4

    4. Attacker

    Keeps the session and uses it as you.

Multi-factor authentication proves who you are in more than one way: something you know, like a password, and something you have, like your phone. It is one of the strongest everyday protections you can turn on. But attackers have adapted — instead of guessing your password, some now try to get you to approve the second step for them, or steal the session after you have already signed in.

Real-world example

Imagine you get a message saying your account has a problem, with a link to sign in. The page looks exactly right. You enter your password and then the code from your authenticator app. Behind the scenes, the page passed both to the real site and kept the resulting session. You saw nothing wrong, yet the attacker is now signed in as you.

How to spot it

  • A prompt you didn't request

    An MFA approval request arrives when you are not signing in anywhere.

  • A flood of prompts in a row

    Several push notifications back to back is a known pressure tactic.

  • A code request on a linked page

    You reached the sign-in page from an email or text link, not by typing the address yourself.

  • A sign-in from somewhere new

    A notification about access from an unfamiliar device or location, right after you signed in.

What to do

  1. 1Never approve an MFA prompt you did not start — deny it and change your password.
  2. 2If a page asks for your password and a code, close it and go to the site directly instead of using the link.
  3. 3Where it is offered, switch to a phishing-resistant method such as a passkey or security key.

Stay curious. Stay safer.

This is one piece of a bigger picture. Explore more real-world examples, concepts and tips to build your cybersecurity awareness.

Explore More

Keep reading