The MFA Level-Up: Why SMS Codes Are No Longer Enough (and What to Use Instead)

Tanya Wetson-Catt • 16 February 2026

For years, enabling Multi-Factor Authentication (MFA) has been a cornerstone of account and device security. While MFA remains essential, the threat landscape has evolved, making some older methods less effective.


The most common form of MFA, four- or six-digit codes sent via SMS, is convenient and familiar, and it’s certainly better than relying on passwords alone. However, SMS is an outdated technology, and cybercriminals have developed reliable ways to bypass it. For organisations handling sensitive data, SMS-based MFA is no longer sufficient. It’s time to adopt the next generation of phishing-resistant MFA to stay ahead of today’s attackers.


SMS was never intended to serve as a secure authentication channel. Its reliance on cellular networks exposes it to security flaws, particularly in telecommunication protocols such as Signaling System No. 7 (SS7), used for communication between networks.


Attackers know that many businesses still use SMS for MFA, which makes them appealing targets. For instance, hackers can exploit SS7 vulnerabilities to intercept text messages without touching your phone. Techniques such as eavesdropping, message redirection, and message injection can be carried out within the carrier network or during over-the-air transmission.


SMS codes are also vulnerable to phishing. If a user enters their username, password, and SMS code on a fake login page, attackers can capture all three in real time and immediately gain access the legitimate account.

 

Understanding SIM Swapping Attacks


One of the most dangerous threats to SMS-based security is the SIM swap. In SIM swapping attacks, a criminal contacts your mobile carrier pretending to be you and claims to have lost their phone. They then request the support staff to port your number to a new blank SIM card in their possession.


If they succeed, your phone goes offline, allowing them to receive all calls and SMS messages, including MFA codes for banking and email. Without knowing your password, they can quickly reset credentials and gain full access to your accounts.


This attack doesn’t depend on advanced hacking skills; instead, it exploits social engineering tactics against mobile carrier support staff, making it a low-tech method with high‑impact consequences.


Why Phishing-Resistant MFA Is the New Gold Standard


To prevent these attacks, it’s essential to remove the human element from authentication by using phishing-resistant MFA. This approach relies on secure cryptographic protocols that tie login attempts to specific domains.


One of the more prominent standards used for such authentication is Fast Identity Online 2 (FIDO2) open standard, that uses passkeys created using public key cryptography linking a specific device to a domain. Even if a user is tricked into clicking a phishing link, their authenticator application will not release the credentials because the domain does not match the specific record.


The technology is also passwordless, which removes the threat of phishing attacks that capture credentials and one-time passwords (OTPs). Hackers are forced to target the endpoint device itself, which is far more difficult than deceiving users.


Implementing Hardware Security Keys


Perhaps one of the strongest phishing-resistant authentication solutions involves hardware security keys. Hardware security keys are physical devices resembling a USB drive, which can be plugged into a computer or tapped against a mobile device.


To log in, you simply insert the key into the computer or touch a button, and the key performs a cryptographic handshake with the service. This method is quite secure since there are no codes to type, and attackers can’t steal your key over the internet. Unless they physically steal the key from you, they cannot access your account.


Mobile Authentication Apps and Push Notifications


If physical keys are not feasible for your business, mobile authenticator apps such as Microsoft or Google Authenticator are a step up from SMS MFA. These apps generate codes locally on the device, eliminating the risk of SIM swapping or SMS interception since the codes are not sent over a cellular network.


Simple push notifications also carry risks. For example, attackers may flood a user’s phone with repeated login approval requests, causing “MFA fatigue,” where a frustrated or confused user taps “approve” just to stop the notifications. Modern authenticator apps address this with “number matching,” requiring the user to enter a number shown on their login screen into the app. This ensures the person approving the login is physically present at their computer.


Passkeys: The Future of Authentication


With passwords being routinely compromised, modern systems are embracing passkeys, which are digital credentials stored on a device and protected by biometrics such as fingerprint or Face ID. Passkeys are phishing-resistant and can be synchronised across your ecosystem, such as iCloud Keychain or Google Password Manager. They offer the security of a hardware key with the convenience of a device that you already carry.


Passkeys reduce the workload for IT support, as there are no passwords to store, reset, or manage. They simplify the user experience while strengthening security.


Balancing Security With User Experience


Moving away from SMS-based MFA requires a cultural shift. Since users are already used to the universality and convenience of text messages, the introduction of physical keys and authenticator apps can trigger resistance.


It’s important to explain the reasoning behind the change, highlighting the realities of SIM-swapping attacks and the value of the protected information. When users understand the risks, they are more likely to embrace the new measures.


While a phased rollout can help ease the transition for the general user base, phishing-resistant MFA should be mandatory for privileged accounts. Administrators and executives must not rely on SMS-based MFA.


The Costs of Inaction


Sticking with legacy MFA techniques is a ticking time bomb that gives a false sense of security. While it may satisfy compliance requirements, it leaves systems vulnerable to attacks and breaches, which can be both costly and embarrassing.


Upgrading your authentication methods offers one of the highest returns on investment in cybersecurity. The cost of hardware keys or management software is minimal compared to the expense of incident response and data recovery.


Is your business ready to move beyond passwords and text codes? We specialise in deploying modern identity solutions that keep your data safe without frustrating your team. Reach out, and we’ll help you implement a secure and user-friendly authentication strategy.

Let's Talk Tech

More from our blog

LinkedIn "Social Engineering": Protecting Your Staff from Fake Recruitment Scams

by Tanya Wetson-Catt • 22 May 2026
A fake recruiter message is one of the cleanest social engineering tricks around because it doesn’t look like a trick. That’s why LinkedIn recruitment scams work so well inside real businesses. They don’t arrive as malware. They arrive as a normal conversation that nudges someone toward one small action: click this link, open this file, “verify” this detail, move the chat to a different app. A few simple checks, a couple of hard-stop rules, and an easy way to report suspicious outreach can shut these scams down without slowing anyone down. LinkedIn Recruitment Scams LinkedIn recruitment scams artfully blend into normal professional behaviour. The message doesn’t look like a “cyber attack.” It looks like networking, and it borrows credibility from recognisable brands, polished profiles, and familiar hiring language. At platform scale, the volume is also hard to wrap your head around. Rest of World reports that LinkedIn said it “identified and removed 80.6 million fake accounts” at registration from July to December 2024. A LinkedIn spokesperson claimed “over 99%” of the fake accounts they remove are detected proactively before anyone reports them. Even with that level of detection, enough scam activity still leaks through to reach real employees. That’s especially true when scammers tailor their approach to what looks credible in a specific industry and location. The other reason these scams succeed is that they follow a predictable persuasion pattern: urgency, authority, and a quick push to “do the next step.” The FTC describes scammers impersonating well-known companies and then steering targets toward actions that create leverage. These actions include handing over sensitive personal information or sending money for “equipment” or other upfront costs. Once someone is rushed into treating the process as real, the scam doesn’t need to be technically sophisticated. It just needs the victim to keep moving. The Scam Pattern Most Teams Miss 1. A polished approach on LinkedIn The profile looks credible enough, the role sounds plausible, and the message is written in a professional tone. The job post itself may still be oddly generic, though. Amoria Bond notes that fake job postings often “lack details” and lean on broad language to catch as many people as possible. 2. A quick push off-platform The conversation shifts to email, WhatsApp/Telegram, or a “recruitment portal” link. That shift is important because it removes the built-in friction of LinkedIn’s environment and makes it easier to send links, files, and instructions.

3. A credibility wrapper: “assessment”, “interview pack”, or “onboarding”

Airswift flags link/attachment requests and urgency tactics as common red flags. The story is usually something like: “Download this assessment,” “Review these onboarding steps,” or “Log in here to schedule.” Tag Apps Make decisions visible and repeatable by tagging apps. Microsoft explicitly calls tagging apps as sanctioned or unsanctioned an important step, because it lets you filter, track progress, and drive consistent action over time. 4. The pivot: money, sensitive info, or account takeover Scammers impersonate well-known companies and then ask for things legitimate employers typically don’t: payment for “equipment” or early requests for personal information. Another variation is more subtle: “verification” steps that are really designed to steal identity details or compromise accounts. 5. Pressure to keep moving If someone hesitates, the scam leans on urgency: “limited slots,” “fast-track hiring,” “complete this today.” That’s why Forbes frames the key skill as slowing down and checking details, because the scam depends on momentum. Red Flags Checklist for Staff Here are the red flags to look out for. Red flags in the job posting The role is oddly vague or overly broad. Generic responsibilities, unclear reporting lines, and “we’ll share details later” language are common in fake listings. The company's presence doesn’t match the brand name. Thin company pages, inconsistent logos/branding, or a web presence that feels incomplete are worth pausing on. The process is “too easy, too fast.” If the listing implies immediate hiring with minimal steps, treat it as suspicious. Red flags in recruiter behaviour They push you off LinkedIn quickly. Moving to WhatsApp/Telegram or personal email early is a common tactic. They use a personal email address or unusual contact details. Be specifically cautious of recruiters using free webmail accounts instead of a company domain. They avoid verification. If they dodge basic questions, treat that as a signal, not a scheduling issue Hard-stop requests Any request for money or fees. Application fees, equipment purchases, “training costs”, gift cards, crypto, that’s a hard stop. Requests for sensitive personal info early. Bank details, identity documents, tax forms, or “background checks” before a real interview process is established. Requests for verification codes. If anyone asks you to read back a one-time code sent to your phone/email, assume they’re trying to take over an account. Requests for non-public company information like org charts, internal system details, client lists, invoice processes and security tools. Look out for requisitions for anything beyond what a recruiter would reasonably need. Stop Scams With Simple Defaults LinkedIn recruitment scams don’t succeed because staff are careless. They succeed because the outreach looks normal, the process feels familiar, and the next step is always framed as urgent. The fix isn’t turning everyone into an investigator. It’s setting simple defaults that make scams harder to complete: slow down before clicking, verify the recruiter and role through official channels, keep conversations on-platform until identity checks out, and treat money requests, code requests, and early personal data demands as hard stops.  When those habits are standardised, the scam loses its leverage.

The "Legacy Debt" Audit: Identifying the 3 Oldest Risks in Your Server Room

by Tanya Wetson-Catt • 18 May 2026
The most dangerous thing in a server room is often the phrase, “Don’t touch that.” It’s usually said with a half-joke and a grimace. It refers to the old box that “still works”, runs something important, and has survived so many fixes and workarounds that nobody feels confident changing it anymore. That’s legacy debt. Not just “old tech”, but old tech that’s become a dependency. It’s the kind that quietly accumulates risk until it turns into downtime, security exposure, or an emergency upgrade at the worst possible time. A legacy debt audit is the fast way to bring that risk back into the light. What Legacy Debt Really Looks Like Legacy debt isn’t “old gear”. It’s old gear that has become normal. It’s the server that runs a critical app, the edge device nobody remembers buying, the workaround that turned into a dependency. Over time, that debt stacks up quietly. Infinite Lambda describes legacy debt as something that “happens even to the best systems,” “silently accruing costs and constraints,” and it can “accumulate basically unnoticed until it is too costly to ignore.” That’s why a legacy debt audit isn’t a theoretical exercise. It’s a visibility exercise to bring the oldest, highest-leverage risks back onto the list of things you actively manage. The security problem shows up when “old” becomes “unpatchable.” The UK’s NCSC guidance on obsolete products says, “Ideally, once out of date, technology should not be used,” and “the only fully effective way to mitigate this risk is to stop using the obsolete product.” If something can’t be updated, weaknesses don’t age out. They sit there, waiting for the wrong day. Legacy debt also looks like basic server hygiene slipping. NIST SP 800-123 frames secure server operations as an ongoing process: “Maintaining the secure configuration through application of appropriate patches and upgrades, security testing, monitoring of logs, and backups…” It also calls out foundational hardening steps like “Patch and upgrade the operating system” and “Remove or disable unnecessary services, applications, and network protocols.” When those basics become inconsistent, legacy debt turns into a reliability and incident-response problem, not just a security one. Finally, legacy debt often hides at the edge. If you have end-of-support internet-facing devices, you’ve got high-leverage risk in the most exposed place. The 3 Oldest Risks to Find First These three categories are where “old” most often turns into outsized risk, because they combine age with leverage: they either sit at the front door, can’t be fixed anymore, or have quietly drifted out of a safe baseline. Risk #1: End-of-support edge devices If you’re looking for high-leverage legacy debt, start at the edge. Firewalls, VPN gateways, routers, and other internet-facing devices are the front door to your environment. When they reach end-of-support (EOS), they don’t just become outdated. They become harder to defend because security fixes stop arriving. What to check in your audit List every edge device (firewall, VPN, router) and the support status for each one Confirm which ones are internet-facing and which services are exposed Identify devices that can’t run the current firmware or no longer receive updates. Risk #2: Obsolete products that can’t be fixed anymore Obsolete products are the purest form of legacy debt: things that are still operating but no longer receive security updates. That means every new vulnerability becomes permanent. In other words, there’s no clever workaround that makes an unsupported system “safe”. There are only risk reductions until you can replace it. What to check in your audit Identify anything past support: server OS versions, appliances, old hypervisors, and line-of-business apps Flag systems that require exceptions, like the ones with old protocols, weak auth, and special firewall rules Find the “business-critical but unsupported” systems. Risk #3: “It still works” servers with neglected basics This is the sneakiest risk because it looks normal. The server is supported. The hardware runs. Nobody’s complaining. But the basics have drifted: patching is inconsistent, unnecessary services are still running, and backups haven’t been proven under pressure. SP 800-123 Guide to General Server Security frames secure server operations as an ongoing discipline, including “patches and upgrades,” “monitoring of logs,” and “backups.” It also calls out core hardening steps like “Patch and upgrade the operating system” and “Remove or disable unnecessary services, applications, and network protocols.” Those are the unglamorous fundamentals that stop small problems from turning into long outages. What to check in your audit Patch reality: what’s the current patch level and how often do updates slip? Service sprawl: what’s running that doesn’t need to be running? Admin and service accounts: where are the broad permissions and shared credentials? Backup confidence: when was the last restore test and did it succeed? Change control: who can make changes, and how are they tracked? Stop Carrying Silent Risk Legacy debt doesn’t announce itself. It sits quietly in the background until the day it becomes downtime, exposure, or an emergency upgrade you didn’t plan for. A legacy debt audit gives you control back by turning “we should deal with that someday” into a shortlist you can act on. Start with the highest-leverage risks: end-of-support edge devices, obsolete products that can’t be patched, and servers where the basics have drifted. Then assign owners, set dates, and move one item at a time from “too scary to touch” to “handled”.  Contact us for help running your next legacy debt audit.

The "Session Cookie" Hijack: Why MFA Can’t Always Save You

by Tanya Wetson-Catt • 15 May 2026
MFA is a strong front-door lock. But it’s not the only thing that decides whether someone can get in. After you sign in, your browser keeps you logged in using a session token (often stored as a cookie). It’s the digital version of a wristband at an event: once you’ve been checked, the wristband proves you belong there. If an attacker steals that wristband, they may not need to beat your MFA prompt at all. That’s the core of session cookie hijacking. The attacker isn’t “cracking” MFA. They’re skipping it by replaying your already authenticated session. This isn’t a reason to stop using MFA. It’s a reason to stop treating MFA as the finish line. When sessions can be stolen, the practical defence shifts to layered controls: phishing-resistant sign-ins, device hygiene, tighter session policies, and detection that catches suspicious access early. Why MFA Isn’t a “Game Over” Control MFA is still one of the best upgrades most businesses can make, but it doesn’t end an attack on its own. The reason is that attackers don’t always try to beat the login step. They try to go around it. Cloudflare notes that “attackers are finding new ways to circumvent MFA” and that modern incidents are rarely one isolated technique. They’re “part of a chain of attacks.” In other words, MFA can block a lot of credential theft, but it doesn’t automatically protect what happens after a user successfully signs in. That’s where session cookie hijacking comes in. Microsoft has described adversary-in-the-middle phishing campaigns where attackers use a reverse-proxy site to “steal and intercept” a user’s password and the session cookie that proves they have an authenticated session. This is “not a vulnerability in MFA.” The attacker isn’t breaking the MFA. They’re reusing the session. What a Session Cookie Is and Why Attackers Want It When you sign into a web app, the site needs a way to remember that you’ve already proved who you are. That’s what a session is: a temporary “logged-in” state that saves you from entering your password and MFA code on every click. Kaspersky explains that session hijacking is “sometimes called cookie hijacking” because cookies are commonly used to store the session identifier that keeps you authenticated. Attackers want that session identifier because it’s the shortcut. Proofpoint describes session tokens as digital “keys” that let a user stay authenticated. It warns that stealing valid tokens lets attackers impersonate legitimate users and potentially bypass authentication measures “like MFA.” That’s why session cookie hijacking is so highly leveraged. If an attacker can steal the cookie or token that represents your active session, they’re not trying to defeat the login process. They’re attempting to reuse what you already completed, and access the same apps and data as if they were sitting at your keyboard. How Session Cookie Hijacking Actually Happens A lot of teams picture “account takeover” as someone guessing a password or tricking a user into approving an MFA prompt. Session cookie hijacking is different. The attacker’s goal is to steal the proof that you’re already logged in, then reuse it, often without triggering another sign-in challenge. 1.) AiTM phishing Adversary-in-the-middle (AiTM) phishing is the “proxy login” trap. You think you’re signing into a normal service, but you’re actually signing into a lookalike page that sits between you and the real site. The attacker relays the login in real time, so everything appears to work, including MFA. Attackers use AiTM phishing sites to “steal and intercept” a user’s password and the session cookie that proves the authenticated session. This is “not a vulnerability in MFA.” The attacker isn’t breaking the MFA. They’re capturing the session after MFA is completed and reusing it. One such campaign “ attempted to target more than 10,000 organisations ” since September 2021, which shows how scalable this approach has become. 2.) Browser-in-the-Middle session stealing Browser-in-the-middle (BitM) is similar in spirit, but it’s even more “hands-on” from the attacker’s side. Instead of stealing a password and running away, the attacker effectively places themselves in control of the browsing session. Google’s threat intelligence says, “Stealing this session token is the equivalent of stealing the authenticated session.” Once the token is stolen, “an adversary would no longer need to perform the MFA challenge.” In other words, the attacker isn’t trying to authenticate instead of you. They’re trying to ride along after you’ve authenticated. 3.) Cookie theft from the endpoint Not every session hijack starts with a fancy proxy. Sometimes the attacker simply steals session data from the device itself. Stealing valid session tokens allows attackers to impersonate legitimate users. Tokens act like digital “keys.” If an endpoint is compromised, those “keys” can be extracted and reused. Invicti explains that an attacker steals HTTP cookies and can gain access. The goal is often to obtain sensitive information stored in cookies. MFA Is a Baseline, Not a Finish Line MFA is still essential. It blocks a huge amount of credential theft and makes basic account takeover harder. But session cookie hijacking is a reminder that attackers don’t always try to defeat the login step. Sometimes they reuse what happens after it. The practical response is layered and realistic. Make phishing harder to pull off, and treat device health as part of identity. Tighten session behaviour for high-risk apps. Watch for suspicious access patterns that suggest a session is being replayed. When those controls work together, MFA stops being a comforting checkbox and becomes what it should be: a strong baseline that’s backed by protections around the session itself.  Contact us today for help protecting your login sessions from hijacking.