Written by Jaiz Anuar

MFA Did Not Fail. The User Was Convinced To Hand Over The Session.

MFA can work exactly as designed while an attacker captures the trust created afterward. Protecting identity now requires continuous confidence in the session, not only successful authentication at the login screen.

For years, Multi-Factor Authentication has been one of the clearest answers to credential theft.

Passwords can be guessed.

Passwords can be stolen.

Passwords can be reused.

MFA adds another layer.

And for a long time, that changed the balance significantly.

But attackers adapt.

They do not always need to defeat the control directly.

Sometimes, they simply convince the user to complete the control for them.

That is an important distinction.

Because the problem is no longer only about stolen credentials.

It is about stolen trust.

Authentication Is No Longer The End Of The Story

Most organisations still think about identity security in a relatively simple sequence.

The user enters a password.

The user completes MFA.

Access is granted.

The process is considered successful.

But modern attacks increasingly target what happens after successful authentication.

The session.

Once the user has authenticated, the platform creates a trusted session that allows the user to continue working without proving their identity again for every action.

That is convenient.

It is also valuable to an attacker.

If the attacker can capture that session, they may no longer need the password.

They may no longer need the MFA code.

The authentication has already happened.

The trust has already been granted.

The User Can Be Used As Part Of The Attack

This is where social engineering becomes more dangerous.

An attacker may not need to trick a user into giving away a password directly.

They may only need to create a believable situation.

A fake IT support call.

A security warning.

A request to reauthenticate.

A convincing login page.

The user enters the credentials.

Approves the MFA prompt.

Everything appears normal.

But the authentication flow is being intercepted.

The attacker is not breaking MFA.

The user is successfully completing MFA.

For the attacker.

That is why the statement matters:

MFA did not fail.

The security control worked.

The user was convinced to hand over the resulting trust.

Strong Authentication Is Still Necessary

This does not mean MFA has become ineffective.

Far from it.

MFA remains one of the most important identity controls an organisation can deploy.

But it should no longer be treated as the final answer.

The better question is not only:

“Did the user authenticate successfully?”

It should also be:

“Do we still trust this session?”

Is the session coming from the expected device?

Has the location changed unexpectedly?

Is the user performing unusual actions?

Has the session suddenly accessed systems the user rarely touches?

Has privilege increased?

Has the authentication method changed?

Identity security must continue after login.

The Session Is Now A Credential Too

Security teams have spent years protecting passwords.

But session tokens deserve similar attention.

A valid session can represent an already authenticated identity.

That makes it extremely valuable.

If a session is stolen, the attacker may inherit the privileges attached to that user without having to repeat the original authentication process.

This changes how organisations should think about identity architecture.

Session lifetime matters.

Reauthentication matters.

Device trust matters.

Conditional Access matters.

Token revocation matters.

Behaviour monitoring matters.

The session should never become an unlimited expression of trust.

Help Desks Are Part Of The Security Architecture

There is another uncomfortable reality.

Identity security is not only controlled by the identity platform.

It is also influenced by the people and processes that can change identity state.

Help desks.

Support teams.

Administrators.

Anyone who can reset a password, enrol a new authentication method or unlock an account becomes part of the identity perimeter.

An attacker may not need to compromise the authentication technology.

They may simply persuade someone with authority to change it.

That means help-desk verification is not just an operational process.

It is a security control.

The same applies to privileged account recovery, MFA reset procedures and identity enrolment.

If those processes are weak, strong authentication can still be undermined.

Phishing-Resistant MFA Changes The Equation

Not all MFA is equal.

Some methods are easier to socially engineer than others.

A push notification can be approved.

A one-time code can be entered into a phishing page.

A user can be pressured into completing an authentication step they do not fully understand.

Phishing-resistant methods such as FIDO2 and passkeys improve this because the authentication is more tightly bound to the legitimate service.

That reduces the opportunity for a fake site to simply relay the authentication process.

The direction therefore should not be:

MFA everywhere and the problem is solved.

It should be:

Use stronger authentication where the risk justifies it, and do not assume authentication alone is enough.

Sensitive Actions Should Require More Than A Valid Session

One of the stronger architectural responses is to separate authentication from authorisation.

A user may be successfully authenticated.

That does not mean every action should automatically be trusted.

Changing MFA settings.

Creating privileged accounts.

Exporting sensitive information.

Approving financial transactions.

Resetting administrative credentials.

These actions may deserve additional verification.

Step-up authentication.

Independent approval.

Device validation.

Additional context.

The idea is simple.

If the session has been stolen, the attacker should still encounter another barrier.

This is where identity architecture becomes more important than the login screen itself.

Final Thoughts

For years, cybersecurity focused heavily on protecting the password.

Then we added MFA.

That was the right move.

Now attackers are adapting again.

They are learning that the easiest path may not be to defeat authentication.

It may be to persuade the user to complete it.

The user enters the password.

The user approves the MFA.

The identity provider creates the session.

The attacker captures the trust that follows.

That is why modern identity security cannot stop at successful authentication.

It must continue throughout the session.

It must understand the device.

Monitor behaviour.

Protect recovery processes.

Strengthen help-desk verification.

And apply stronger controls to sensitive actions.

Because the next identity compromise may not happen because MFA failed.

It may happen because MFA worked exactly as designed.

For the wrong person.

Question assumptions. Share knowledge. Build trust.