Multifactor authentication is one of the strongest basic protections available to users.
But MFA does not make every login request legitimate.
Microsoft's 2026 research documented attacks in which criminals used social engineering to persuade users to complete authentication steps that ultimately benefited the attacker.
The distinction matters.
If you approve a malicious authentication request, the second factor can become part of the attack rather than a defence against it.
Phishing-resistant methods such as passkeys can reduce some of these risks, but users should still treat unexpected authentication prompts as suspicious.
Never approve a login you did not initiate.