Phishing-Resistant MFA and the Limits of Text Message Codes

Text message codes are better than nothing. If your organization uses them today, keep them on while you plan the next step.

Picture a contact center with agents working from home and a nearshore site in another country. Every agent signs in with a password and a code texted to a personal phone. Numbers change when people switch carriers, and texts sometimes arrive late. The codes are also the weakest second factor available.

Multifactor authentication (MFA) asks for a second proof of identity after the password. How much that proof is worth depends on how easily it can be intercepted, tricked, or relayed. This post covers where codes fall short, what holds up better, and how an in-house IT manager and an MSP (managed service provider) can split the rollout.

Where text codes and push prompts break

SIM swapping. An attacker talks a phone carrier into moving your number to a SIM (the chip that identifies a phone) they control. Your texts, including sign-in codes, now arrive on their phone. It takes a stolen password and some social engineering of the carrier.

Push bombing, also called MFA fatigue. The attacker already has a password and keeps triggering approval prompts on the user’s phone. Agents on night shifts get odd-hour prompts anyway, so a bogus one is easy to miss. Sooner or later someone taps Approve to make the buzzing stop.

Relay phishing. Kits known as adversary-in-the-middle (AiTM) phishing sit between your user and the real Microsoft sign-in page. The user types a password and a code into a fake page. The kit passes both along in real time and keeps the session the real site hands back. The code was correct, and it still lost.

None of this makes codes useless. They stop cheap attacks, like a password reused from a breached website. Cyber insurance applications commonly ask whether MFA covers email, remote access, and admin accounts, and codes can answer yes. They just leave the larger gaps open.

Number matching closes one gap

With number matching in Microsoft Authenticator, the sign-in screen shows a two-digit number and the user types it into the app. A blind tap no longer works, which takes most of the sting out of push bombing.

It does not stop a relay kit. A user on a fake page will type the number in anyway. Still, it costs nothing, so confirm it is on for your tenant (your Microsoft 365 environment). It also moves people off text messages, which helps with the foreign-carrier problem too.

What phishing-resistant means

A phishing-resistant method uses a cryptographic key that only works for the real website address. A lookalike page gets nothing it can reuse, no matter how convincing it looks.

The options in a Microsoft 365 environment:

• FIDO2 security keys. Small USB or NFC devices you touch to sign in. FIDO2 is the open standard behind them.
• Passkeys. The same technology, stored on a phone or computer and unlocked with a fingerprint, face, or PIN.
• Windows Hello for Business. A key tied to a specific Windows PC and unlocked with a PIN or face.

Which one fits depends on the person. Agents on shared or hot-desked workstations suit hardware keys. A consultant with one assigned laptop does fine with Windows Hello. Staff who move between devices often prefer a passkey on a managed phone.

Nothing here is bulletproof, and a stolen laptop that is already signed in is still a problem. The three attacks above mostly stop working.

A rollout plan for co-managed IT

Go in order, and do not try to move everyone at once.

1. Administrators first: the IT manager, MSP technicians, and the owner or CIO. Give each two keys and store the spare somewhere safe.
2. Anyone with access to finance, customer data, or the systems that run the business, such as your ERP (enterprise resource planning), CRM (customer relationship management), or contact center platform.
3. Everyone else, once the first two groups have run for a few weeks without surprises.

In co-managed IT, the split usually follows what each side can see. Your internal IT team knows the people and the hardware. They typically handle:

• Buying and labeling keys, registering them with each person, and replacing lost ones
• Shipping keys to home addresses and to the nearshore site, which takes longer than anyone plans for
• Short training sessions, scheduled around shifts
• Telling the MSP when someone joins, leaves, or changes roles

The MSP handles policy and watching. That usually means:

• Setting the authentication methods policy and Conditional Access rules in Microsoft Entra ID
• Turning off text message codes for a group only after every member has a key or passkey registered
• Watching sign-ins for repeated prompts, risky logins, and sign-ins from unusual places
• Recording exceptions and who approved them

Agree on the lost-key process before you need it. Decide who can issue a temporary access pass and how they confirm the person asking. A caller who says “I lost my key and I’m locked out” is exactly what an attacker will say. A callback to a number already on file works well.

What to do this month

Check three things. Is number matching on? Does every administrator have a second factor that is not a text message? Who could approve a temporary access request, and how would they verify it?

The first two take an afternoon. The third takes a conversation between operations, the IT manager, and the MSP.

We work alongside internal IT teams on this. We set up the policies in Microsoft Entra ID and watch for signs that a code was relayed anyway, such as a sign-in from a new country minutes after a local one. We can end that session and force a fresh login. Your IT manager keeps ownership of people and hardware. See our cybersecurity services and managed IT services.

Call us at 405-253-5101 or schedule a discovery call to get on the calendar.