MFA phishing is an attack that tries to get a person to disclose a multi-factor authentication code, approve an unexpected sign-in request, or otherwise help an attacker complete a login. Some campaigns use convincing fake sign-in pages; others send repeated prompts to pressure a user into approving one. If successful, the attacker may gain access even though the account has multi-factor authentication enabled.
Success depends on the authentication method and session protections. One-time codes and approval prompts can be susceptible to interception or trickery, while phishing-resistant methods such as passkeys or security keys are designed to bind authentication to the legitimate site or service. Defenses include training users to reject unexpected prompts, limiting session lifetimes, monitoring unusual sign-ins and activity, and promptly revoking suspicious sessions or credentials.