SMS and TOTP Can Both Be Phished in Real Time — Here's Which MFA Methods Are Actually Phishing-Resistant

Multi-factor authentication doesn't replace passwords — it creates a second authentication factor that an attacker needs in addition to the password, and the specific security of each MFA method depends on what that second factor is and whether it can be intercepted, phished, or bypassed in real-time

The previous articles on this site covered password strength, zero-knowledge password managers, passkeys and FIDO2, credential stuffing, and entropy and CSPRNG. This article addresses multi-factor authentication security — specifically the security differences between different MFA methods, which MFA types are vulnerable to phishing attacks, and why passkeys (the previous article's subject) represent a more fundamental shift than MFA.

The MFA spectrum: from easy-to-phish to phish-resistant

Not all MFA is equally secure. The methods range from "better than nothing but still phishable" to "phishing-resistant by design":

SMS OTP (one-time password via text message):

• How it works: a 6-digit code is sent to your phone number; you enter it when logging in
• Security weakness: SIM swapping — attackers convince carriers to transfer your phone number to their SIM; SS7 protocol vulnerabilities — phone networks have known weaknesses enabling interception; real-time phishing — an attacker who gets you to enter your password on a fake site can also relay your OTP in real time before it expires
• Security rating: better than password-only, but the weakest MFA method

TOTP (Time-based One-Time Password, e.g., Google Authenticator, Authy):

• How it works: an app generates a 6-digit code that changes every 30 seconds, based on a shared secret and the current time (RFC 6238)
• Security weakness: still vulnerable to real-time phishing — if you enter a TOTP code on a phishing site, the attacker has 30 seconds to relay it to the legitimate site before it expires
• Security rating: better than SMS (no SIM swap risk), but still phishable

Hardware security keys (FIDO U2F / FIDO2 / WebAuthn):

• How it works: a physical USB or NFC key performs a cryptographic challenge-response authentication. The key's response includes a hash of the URL being authenticated
• Phishing resistance: the URL hash means the key's response is specific to example.com — even if you're on a phishing site examp1e.com, the key won't produce a valid response for example.com. The phishing site can't relay the key response
• Security rating: phishing-resistant by design

Passkeys (platform FIDO2, as covered in the previous article):

• Same phishing-resistant WebAuthn protocol as hardware keys, but using device biometrics/PIN instead of a physical token
• Security rating: phishing-resistant, equivalent security to hardware keys for most threat models

The real-time phishing attack against TOTP

The AiTM (Adversary-in-The-Middle) attack against TOTP-protected accounts:

1. Attacker sends a phishing email with a convincing link to yourbank-secure-login.com
2. Victim enters username and password — attacker relays these to the real bank in real time
3. Real bank sends MFA request → victim's phone shows TOTP prompt
4. Victim enters TOTP code on the phishing site → attacker relays to real bank before 30-second expiry
5. Attacker is now authenticated to the real bank; session cookie is captured
6. Victim sees "incorrect login" or is redirected; their account is compromised

This attack class (Evilginx2, Modlishka, and other frameworks automate it) is actively used against large-scale targets — financial accounts, Microsoft 365 accounts, and any service using TOTP-based MFA.

Why hardware keys/passkeys prevent this: the WebAuthn protocol's challenge includes the relying party's registered origin. The challenge for yourbank.com is cryptographically bound to that exact URL. When relayed through a phishing proxy, the origin changes — and the hardware key's response (which includes a hash of the correct origin) no longer matches, causing authentication to fail.

TOTP implementation security: secrets and backup codes

When you set up TOTP MFA, you typically scan a QR code containing the TOTP secret — a base32-encoded random string used as the shared secret for code generation.

Security risks with TOTP secrets:

• The secret is stored in your TOTP app and on the service's server
• If either is compromised, an attacker can generate all future TOTP codes indefinitely
• Screenshots of setup QR codes (sent by insecure email, stored in cloud photo backups) expose the secret

Backup codes: services typically provide 8-10 single-use backup codes at setup. These are the fallback if you lose your authenticator device. Backup codes are as powerful as the TOTP secret — anyone with a backup code can bypass MFA once. Store them in your password manager or in secure physical storage, not in an email folder labelled "backup codes."

Push notification MFA: the MFA fatigue attack

Push notification MFA (Microsoft Authenticator, Duo, Okta Verify) sends a push notification to your phone: "Approve sign-in?" — you tap Approve or Deny.

The MFA fatigue (push bombing) attack:

1. Attacker has compromised the victim's password (via phishing, data breach)
2. Attacker repeatedly triggers login attempts, sending dozens of MFA push notifications
3. Victim, confused or fatigued by the notifications, eventually taps "Approve"
4. Account compromised

This attack has been used in real breaches — the 2022 Uber breach specifically used MFA fatigue via WhatsApp messages alongside push bombing.

Mitigations:

• Number matching: Authenticator apps show a 2-digit number in the push; the user must find and enter the matching number shown on the login screen. Eliminates rubber-stamping "Approve" without verifying context
• Additional context in push notifications: display the login location, application, and device in the push — unusual context should trigger denial
• Rate limiting push attempts: blocking or warning after multiple push requests in a short time

Passwords as something you know: the authentication factors

The "three factors" of authentication:

1. Something you know: password, PIN, security question answer
2. Something you have: phone (SMS/TOTP), hardware key, authenticator app, smart card
3. Something you are: fingerprint, face recognition, iris scan, voice

True MFA uses two different factor types. SMS OTP (something you have) combined with a password (something you know) is genuine MFA. Two passwords would be "two-factor" but not true multi-factor (both are "something you know").

Why security questions fail as a second factor: security questions are still "something you know" — mother's maiden name, first school, childhood friend's name. They're typically guessable from social media, public records, or social engineering. They're a second factor from the same category as a password, providing less additional security than a truly different factor.

How to use the Password Generator on sadiqbd.com

1. Strong MFA recovery passwords: generate strong passwords for accounts where your MFA method is a hardware key (which can be lost) — the recovery option must be as strong as the primary authentication
2. Per-service unique passwords as MFA layer 0: MFA protects against password database breaches, but unique passwords (generated per service) ensure that breaching one service's database doesn't enable access to others
3. Password for TOTP backup codes storage: if storing backup codes in a password-protected document, generate a strong password for that document using the tool

Frequently Asked Questions

If I use a password manager, do I still need MFA? Yes — they protect against different threats. A password manager ensures you use unique, strong passwords per service — protecting against credential stuffing (using a leaked password from one service at another). MFA protects against scenarios where an attacker has your correct password — whether through phishing, database breach, or guessing. A password manager user without MFA who clicks a phishing link and enters their password is compromised. A password manager user with phishing-resistant MFA (hardware key or passkey) who clicks a phishing link enters their password on the phishing site, but the MFA authentication fails (wrong URL), and the account is protected. Both layers serve different purposes.

Is the Password Generator free? Yes — completely free, no sign-up required.

Try the Password Generator free at sadiqbd.com — generate strong, cryptographically secure passwords for any use case.