Fake login pages steal passwords, and repeated push prompts wear users down until they approve. Adversary-in-the-middle kits can steal session tokens even when MFA is used.
Why it matters
For Phishing, credential phishing is rarely a purely technical question. It touches ownership, budget and how quickly decisions can be made when something goes wrong. Teams that agree on these points in advance spend less time debating them under pressure.
What to check
- Use number matching or phishing-resistant MFA
- Alert on many failed MFA prompts
- Revoke sessions after a suspected compromise
Where to start
Passkeys and FIDO2 keys remove most of this risk. Write down what you decide, who owns it and when it will be reviewed. That record is often the evidence a reviewer asks for later.