Why 2FA Doesn’t Stop Every Account Takeover Method
Two-factor authentication is, without question, one of the single most effective, broadly recommended account security improvements available — but "dramatically reduces risk" and "makes account takeover impossible" are meaningfully different claims, and several well-documented attack techniques specifically exist to defeat or bypass common 2FA implementations, particularly the more common, lower-friction ones.
Why 2FA Genuinely Stops the Most Common Attack: Simple Credential Theft
Standard 2FA is specifically, genuinely effective against the most common account compromise scenario: an attacker who has obtained a valid username and password (through a data breach at another service, a phishing page capturing credentials, or a successful brute-force guess as discussed elsewhere on this blog) but nothing else. Without also possessing the second factor — a code from an authenticator app, a physical security key, or a code sent via SMS — the stolen password alone is insufficient to complete a login, which is precisely the scenario 2FA was designed to prevent and does prevent extremely effectively.
Real-Time Phishing Proxies: Capturing the Second Factor Too
A more sophisticated attack technique uses a real-time phishing proxy — a fraudulent site that doesn't just capture a username and password, but sits as an active intermediary between the victim and the genuine login service in real time, relaying the victim's actual password and 2FA code through to the real service as the victim enters them, capturing the resulting authenticated session for the attacker's own use. Because the victim is interacting with what functions as a live, real-time relay to the genuine service, even a correctly entered, momentarily valid 2FA code gets captured and used by the attacker before it expires, defeating standard 2FA's core protection specifically because the attack captures the complete, successful authentication flow in real time rather than trying to guess or replay a stale, already-expired code.
SIM Swapping: Attacking SMS-Based 2FA at Its Weakest Link
SMS-delivered 2FA codes carry a specific, well-documented vulnerability: an attacker who successfully social-engineers a victim's mobile carrier into transferring the victim's phone number to a SIM card the attacker controls (a "SIM swap") subsequently receives any SMS-delivered 2FA codes intended for the victim directly, entirely bypassing the actual account credentials altogether if the attacker can also separately obtain or reset the account's password through channels tied to that now-hijacked phone number. This specific weakness is precisely why security guidance has increasingly shifted toward recommending authenticator apps or hardware security keys over SMS-based 2FA specifically, since SMS delivery depends on the mobile carrier's own security practices, an entirely separate and often weaker link outside the actual service's own control.
Session Token Theft: Bypassing the Login Process Entirely
Once a user successfully authenticates (having correctly passed both password and 2FA checks), the service typically issues a session token — a piece of data proving the user is already authenticated, avoiding the need to re-enter credentials on every single subsequent request. Malware running on a victim's own device, or a successful cross-site scripting attack, can potentially steal this already-authenticated session token directly, allowing an attacker to impersonate the logged-in session without ever needing to pass through the login process, and therefore the 2FA check, at all — the attack occurs entirely after successful authentication rather than trying to defeat the authentication process itself.
Why This Doesn't Mean 2FA Isn't Worth Using
None of these bypass techniques argue against using 2FA — they argue for understanding its actual, specific scope of protection rather than treating it as an absolute, unconditional guarantee. Each of the bypass techniques described requires meaningfully more sophistication, effort, and often direct targeting of a specific victim than the simple, high-volume credential-stuffing and brute-force attacks (discussed elsewhere on this blog) that standard 2FA stops cold — meaning 2FA still provides a dramatic, genuine risk reduction against the overwhelming majority of real-world account takeover attempts, even while a smaller subset of more sophisticated, targeted attacks can potentially work around it.
Choosing a Stronger Second Factor Where It Matters
For genuinely high-value accounts — an email account that could be used to reset passwords on other services, an administrative account with broad site access — upgrading from SMS-based 2FA to an authenticator app, or ideally a hardware security key (like a YubiKey, which uses a cryptographic challenge-response protocol specifically resistant to real-time phishing proxy attacks in a way that a simple time-based code is not), meaningfully closes several of the specific bypass techniques described above, at the cost of somewhat more setup friction than SMS-based codes.
What Additional Practices Complement 2FA's Real Limitations
Given these specific, documented bypass techniques, complementary practices worth adopting include: genuine phishing awareness (recognizing suspicious login page URLs before entering any credentials, real-time proxy attacks included, since the fraudulent page's URL is still ultimately distinguishable from the genuine service's actual domain upon careful inspection), keeping devices free of malware that could steal session tokens, and using hardware security keys specifically for the highest-value accounts where the additional protection against phishing proxy attacks genuinely justifies the extra setup effort.
The Takeaway
Two-factor authentication remains one of the single most effective account security measures available and dramatically reduces risk against the overwhelming majority of real-world attack attempts — but real-time phishing proxies, SIM swapping against SMS-based codes, and session token theft each represent genuine, documented techniques that can bypass or defeat it in specific circumstances, meaning 2FA is best understood as a dramatic risk reduction rather than an absolute, unconditional guarantee against every possible account takeover method.
Tags: account security, phishing, SIM swapping, two-factor authentication