Your Password Was Stolen — Can MFA Still Protect Your Account?

Imagine that an employee receives an email that appears to come from Microsoft.

The message says the employee's Microsoft 365 password is about to expire. There is a button to sign in and keep the account active.

The employee clicks it.

The page looks exactly like a Microsoft login page.

They enter their email address and password.

The page reports an error, redirects somewhere else, and the employee continues working.

Nothing obviously happened.

But the password may now be in an attacker's hands.

This is one reason businesses increasingly use multi-factor authentication (MFA). Even if someone obtains a password, MFA can provide another barrier before that person can access the account.

But MFA is not magic.

Some MFA methods are stronger than others, and modern attackers have developed techniques specifically designed to get around poorly implemented authentication.

Understanding what MFA does—and what it doesn't do—is an important part of protecting business email, cloud services, remote access, and other critical accounts.

Why Passwords Alone Are a Problem

Passwords have protected computer accounts for decades.

The concept is simple:

You know something that nobody else knows.

Unfortunately, passwords can be:

Phished

Reused

Guessed

Stolen by malware

Captured from compromised websites

Shared between employees

Exposed in data breaches

Stored insecurely

Once an attacker obtains a valid username and password, a system protected only by those credentials may have difficulty distinguishing the attacker from the legitimate user.

The attacker knows the secret.

That's the fundamental problem MFA attempts to address.

What Is Multi-Factor Authentication?

Multi-factor authentication requires more than one type of evidence before granting access.

Authentication factors are commonly grouped into categories such as:

Something you know — a password or PIN

Something you have — a phone, security key, or trusted device

Something you are — a biometric characteristic such as a fingerprint

A typical business login might therefore require:

Password + authenticator application

instead of simply:

Password

If an attacker steals only the password, one piece of the authentication process is still missing.

What Happens If Someone Steals Your Password?

Suppose an employee's Microsoft 365 credentials are:

employee@company.com

plus a stolen password.

Without MFA, an attacker may be able to attempt to sign in using those credentials.

With MFA enabled, the attacker may also need another authentication factor.

Depending on the system, that could be:

A temporary code

An authenticator-app approval

A hardware security key

A passkey

A biometric confirmation

The stolen password is still a serious security incident, but it may no longer be sufficient by itself to access the account.

This is one of MFA's greatest advantages.

How Passwords Get Stolen: Phishing

Phishing remains one of the most familiar methods for stealing credentials.

An attacker sends a message designed to create urgency:

Your mailbox has exceeded its storage limit.

Your password expires today.

A document has been shared with you.

Your Microsoft 365 account requires verification.

An unusual login was detected.

The link leads to a fraudulent login page.

Modern phishing pages can look extremely convincing. They may reproduce logos, fonts, colors, and layouts from legitimate services.

The objective is simple:

Convince the user to voluntarily provide credentials.

This is why employee education is important—but it is also why technical controls should not assume employees will identify every malicious message correctly.

Password Reuse Creates Another Problem

Suppose an employee uses the same password for a business account and an unrelated website.

That unrelated website suffers a data breach.

Attackers may obtain credentials associated with the employee's email address and try them against other services.

This is commonly associated with credential stuffing.

The attacker doesn't necessarily need to hack the company's systems.

They simply test credentials that were compromised somewhere else.

Unique passwords reduce this risk.

MFA adds another barrier.

MFA Can Stop Many Password-Based Attacks

If an attacker has the correct password but doesn't possess the required second factor, the login can be blocked.

This can be highly effective against many attacks involving:

Stolen passwords

Password reuse

Credential stuffing

Basic phishing

Password guessing

But there is an important qualification:

Not every form of MFA provides the same level of protection.

SMS Codes Are Better Than a Password Alone—but Have Limitations

One familiar MFA method sends a code by text message.

The user enters a password, receives a code on a phone, and enters the code to complete the login.

This adds meaningful protection compared with relying only on a password.

But SMS-based authentication has limitations.

Phone numbers can be targeted through social engineering and SIM-related attacks. Messages can potentially be intercepted in certain circumstances, and users can still be tricked into entering SMS codes into fraudulent websites.

For higher-value business accounts, stronger authentication methods may be preferable when supported.

The important point isn't that SMS authentication is useless.

It's that MFA methods exist on a spectrum of security strength.

Authenticator Apps

Authenticator applications can provide stronger alternatives to SMS.

Depending on the system, the application may generate temporary codes or receive authentication requests directly.

Examples include authentication systems integrated with Microsoft, Google, and other identity providers.

Authenticator applications remove some of the risks associated with SMS, but users can still make mistakes.

For example, an attacker who knows a user's password may repeatedly trigger approval requests.

Eventually, a distracted employee may approve one.

That leads to another attack technique.

What Is MFA Fatigue?

Imagine receiving an authentication request on your phone.

You reject it.

A minute later, another appears.

Then another.

Then another.

Eventually, you may assume an application is malfunctioning and press Approve simply to make the notifications stop.

Attackers know this.

Repeatedly generating authentication prompts in the hope that a user eventually approves one is sometimes called MFA fatigue or MFA push bombing.

Employees should understand a simple rule:

If you did not initiate the login, do not approve the authentication request.

An unexpected MFA request can itself be a warning that someone may already know the password.

Number Matching Improves Push Authentication

Some authentication systems improve push notifications by displaying a number on the login screen that the user must match in the authenticator application.

Instead of simply asking:

Approve?

the system requires interaction tied to the actual login attempt.

This helps reduce accidental approvals and makes blind MFA-prompt attacks more difficult.

Authentication technology continues to evolve specifically because attackers adapt to older security controls.

Can Attackers Phish MFA Codes?

Yes.

Consider a sophisticated phishing page that operates in real time.

The victim enters a username and password.

The attacker immediately submits those credentials to the legitimate service.

The legitimate service requests an MFA code.

The fraudulent page then asks the victim:

Enter your verification code.

The victim enters it.

The attacker submits that code to the real service.

Traditional one-time codes can therefore still be vulnerable to phishing.

This is why security professionals increasingly distinguish between ordinary MFA and phishing-resistant authentication.

What Are Passkeys?

Passkeys are a newer approach designed to reduce dependence on traditional passwords.

Instead of authenticating by sending a reusable secret that a user can accidentally type into a fraudulent website, passkeys use cryptographic credentials associated with the legitimate service.

The user may authenticate using a device, PIN, fingerprint, facial recognition, or another local verification mechanism.

One major security advantage is resistance to conventional credential phishing.

A fake website cannot simply ask you to type your passkey into a text box and then reuse it somewhere else in the way it can steal a password.

As support continues to expand, passkeys and related phishing-resistant technologies are becoming increasingly important for account security.

Hardware Security Keys

Hardware security keys provide another strong authentication option.

These are physical devices used during authentication.

Modern security keys can use standards designed to authenticate specifically to the legitimate website or service.

This makes them highly resistant to conventional phishing.

Hardware keys can be particularly appropriate for accounts with elevated privileges, including:

Administrators

IT personnel

Financial accounts

Executives

Users with access to highly sensitive systems

They also introduce operational considerations.

Businesses need procedures for lost keys, replacement keys, backup authentication methods, and employee onboarding and offboarding.

Strong security still needs good administration.

What Is Phishing-Resistant MFA?

Phishing-resistant authentication is designed so that a user cannot easily hand an attacker a reusable authentication credential through a fraudulent website.

Technologies based on modern cryptographic authentication standards can verify the legitimate service rather than simply asking the user to type a temporary secret.

This is fundamentally different from a one-time code that can potentially be entered into either a legitimate or fraudulent website.

For sensitive accounts, phishing resistance should be considered when choosing authentication methods.

MFA Has Another Important Weakness: Session Theft

Even strong authentication doesn't solve every security problem.

After you successfully authenticate to a website, the service generally doesn't ask you to enter your password and MFA factor every time you click something.

Instead, the browser maintains an authenticated session.

That session is represented by information such as authentication tokens or cookies.

If malware or a sophisticated adversary steals a valid authenticated session, an attacker may potentially attempt to use that session without repeating the original login process.

This is sometimes referred to broadly as session hijacking or token theft.

The important lesson is:

MFA protects authentication, but account security doesn't end after authentication succeeds.

Endpoint security, browser security, session controls, malware protection, and identity monitoring still matter.

Why Administrator Accounts Need Extra Protection

Not every account presents the same level of risk.

A compromised ordinary user account is serious.

A compromised administrator account can be substantially more damaging because administrative privileges may allow changes to:

User accounts

Security settings

Email configuration

Permissions

Cloud applications

Authentication methods

Data access

Other administrator accounts

Administrative accounts should therefore receive additional protection.

Good practices can include:

Strong authentication

Separate administrative accounts

Limited administrative privileges

Phishing-resistant authentication where appropriate

Monitoring

Avoiding routine work from privileged accounts

An employee who only needs email and documents generally should not have organization-wide administrative privileges.

MFA for Microsoft 365

Microsoft 365 can contain a significant portion of a company's information:

Business email

OneDrive files

SharePoint documents

Teams information

Contacts

Calendars

and potentially access to other connected business applications.

A compromised Microsoft 365 account can therefore be much more than an email problem.

Multi-factor authentication should be part of a broader Microsoft 365 security strategy that also considers administrative roles, account recovery, conditional access where available, device security, email protection, and user permissions.

MFA for Google Workspace

The same principle applies to Google Workspace.

A Google Workspace account may provide access to:

Gmail

Google Drive

Shared files

Google Calendar

Google Meet

Contacts

and connected third-party services.

Strong authentication can significantly reduce the risk that a stolen password alone results in account compromise.

Businesses should evaluate the authentication options available for their Workspace environment and apply stronger protection to important and privileged accounts.

MFA Should Also Protect Remote Access

Cloud email isn't the only system that needs protection.

Businesses may have remote access to:

VPNs

Remote desktops

Cloud servers

Administrative portals

Backup systems

Firewalls

Network equipment

Website administration

Accounting systems

Any Internet-accessible service that relies only on a username and password deserves careful evaluation.

Where supported, MFA can provide another important layer of protection.

What Should You Do When an Unexpected MFA Prompt Appears?

Don't approve it.

If you did not initiate a login and suddenly receive an authentication request, treat it as potentially suspicious.

A sensible response may include:

Reject the request

Change the account password through the legitimate service

Review recent sign-in activity

Notify whoever manages your business IT

Check whether other security information has changed

Review active sessions where appropriate

An unexpected MFA request may mean someone has entered your username and password somewhere.

It is worth investigating.

What If an Employee Accidentally Approves a Fraudulent Request?

Act quickly.

Depending on the service and circumstances, appropriate actions can include:

Resetting the password

Revoking active sessions

Reviewing recent logins

Checking MFA methods

Reviewing account recovery information

Checking mailbox forwarding rules

Reviewing administrative changes

Examining connected applications

Checking for suspicious email activity

Simply changing the password may not always be sufficient if the attacker has already established another method of access.

Watch for Malicious Email Rules

Business email compromise deserves particular attention.

An attacker who gains access to a mailbox may create forwarding or inbox rules designed to hide messages or copy information elsewhere.

For example, messages containing words such as:

Invoice

Payment

Wire transfer

Bank

might be moved, deleted, or forwarded.

The legitimate user may not immediately realize anything is wrong.

This is one reason account-compromise investigations should examine more than just the password.

MFA Does Not Replace Good Password Practices

Using MFA does not mean passwords no longer matter—unless the organization has intentionally moved to an appropriate passwordless authentication system.

Where passwords remain in use, businesses should still encourage:

Unique passwords

Long passwords

Secure password management

No credential sharing

No password reuse between personal and business services

MFA should complement good credential management rather than excuse poor password practices.

MFA Does Not Replace Endpoint Security

A strongly protected account can still be accessed from a compromised computer.

If malware controls an employee's device, attackers may be able to steal information, monitor activity, capture sessions, or otherwise interfere with legitimate use.

Businesses still need:

Security updates

Endpoint protection

Malware protection

Secure configuration

Appropriate user permissions

Network security

Backup and recovery

Cybersecurity works best in layers.

The Security-Layer Approach

Think of business security as a series of barriers.

An attacker might first encounter:

Email filtering

Then:

Employee awareness

Then:

A strong unique password

Then:

MFA

Then:

Device security

Then:

Access controls

Then:

Network protections

And if all preventive measures fail:

Backup and disaster recovery

No individual layer is perfect.

The objective is to prevent one mistake or one compromised credential from immediately becoming a complete business compromise.

Which Accounts Should Have MFA?

For a business, the practical answer is:

As many important accounts as reasonably possible.

Priority should be given to:

Business email

Microsoft 365

Google Workspace

Administrator accounts

Remote access

VPN

Financial systems

Cloud services

Backup systems

Domain registrar accounts

Website administration

Password managers

Network and security administration

Accounts capable of resetting or controlling other accounts deserve particularly strong protection.

Don't Forget Your Domain Registrar

This account is often overlooked.

Your domain registrar can control important DNS records associated with your business domain.

Those records may affect:

Your website

Business email

Email authentication

Cloud services

An attacker who gains control of the domain-management account can potentially cause significant disruption.

The registrar account should therefore use strong authentication and carefully controlled administrative access.

MFA Is One of the Highest-Value Security Improvements a Business Can Make

Multi-factor authentication is not perfect.

It cannot compensate for every security weakness.

It doesn't eliminate phishing.

It doesn't make malware harmless.

It doesn't replace backups.

And it doesn't mean an account can never be compromised.

But it changes an important part of the attacker's equation:

Stealing a password may no longer be enough.

For businesses still protecting critical systems with only usernames and passwords, implementing MFA is one of the most practical improvements available.

The next step is choosing appropriate authentication methods and protecting the systems that matter most.

Protect More Than the Password

Modern business security should assume that passwords can eventually be exposed.

The objective is to make a stolen password insufficient on its own and to limit what happens if an account is compromised.

That means combining:

Strong authentication

Appropriate permissions

Security updates

Endpoint protection

Email security

Network security

Monitoring

and

Reliable backup and recovery

Wireknots helps Chicago-area businesses improve Microsoft 365, Google Workspace, business email, computer, network, cloud, and account security, including multi-factor authentication and practical cybersecurity configuration.

Learn more about our Cybersecurity & IT Security Services or contact Wireknots to review how your business accounts and systems are currently protected.