Any MFA beats no MFA. That should be said first, because the most damaging setting in a small business is still an account with only a password. But not all MFA is equal, and attackers have spent the last few years learning exactly how to get around the common kinds.
How Do the MFA Methods Compare?
| Method | Phishing-resistant | Main weakness | Good for |
|---|---|---|---|
| SMS or voice code | No | SIM swap, interception, phishing | Fallback only |
| Email code | No | Email account may already be compromised | Avoid for important accounts |
| Authenticator app push (no number match) | No | MFA fatigue, approving by reflex | Should be phased out |
| Authenticator app with number matching | No | Adversary-in-the-middle phishing | Most staff |
| FIDO2 security key | Yes | Lost keys; cost of hardware | Admins, finance, executives |
| Passkeys | Yes | Device and account recovery planning | Growing option for all staff |
| Windows Hello for Business | Yes | Tied to managed Windows devices | Staff on company laptops |
Why Is SMS Considered Weak?
Three reasons. First, a fake login page can simply ask you for the code and pass it along in real time. Second, criminals can sometimes convince a mobile carrier to move your number to their SIM card, known as SIM swapping. Third, text messages are not encrypted end to end. The Canadian Centre for Cyber Security and the U.S. CISA both recommend phishing-resistant methods over SMS for higher-risk accounts.
Why Does Ordinary MFA Get Bypassed?
The main technique now is adversary-in-the-middle phishing. The attacker's page sits between you and Microsoft. You enter your password, approve your MFA, and Microsoft issues a session cookie, which the attacker captures. They now have a logged-in session. Your MFA worked exactly as designed, and it did not matter.
The other common technique is MFA fatigue: sending push prompt after push prompt until a tired user taps Approve. Number matching, where you type a number shown on the login screen into the app, largely solves this.
What Makes MFA Phishing-Resistant?
Phishing-resistant MFA cryptographically binds the login to the real website's address. A FIDO2 key or passkey will not respond to a lookalike domain, so there is nothing for a fake page to capture. The user does not have to spot the fake. The technology does it for them.
What Should a Canadian SMB Do?
A practical rollout:
- Today: MFA on for every account. No exceptions for executives or "the shared reception mailbox".
- This month: Switch from SMS to an authenticator app with number matching for all staff. Remove SMS as an option where possible.
- This quarter: Issue FIDO2 security keys or passkeys to global administrators, finance staff who release payments, and executives.
- Next: Use conditional access to require phishing-resistant MFA for admin roles and sensitive apps, and require managed devices.
- Always: Lock down MFA resets at the help desk, since attackers now phone in pretending to be staff.
Budget for at least two keys per admin, so a lost key is not a lockout. Our Microsoft 365 and email security team can plan the rollout, and our guide on securing Microsoft 365 shows how MFA fits with the rest of the configuration.