Why MFA Success Does Not Prove Identity or Ongoing Trust

Summary

MFA confirms control of registered authenticators, not a person’s real-world identity or the legitimacy of later activity. Weak recovery and enrollment processes, session hijacking, and post-login changes require separate identity verification and ongoing detection.

Key points

• Authentication verifies control of an account’s registered authenticators; identity proofing verifies that a person matches the claimed identity.
• Social-engineering a help desk to reset MFA or enroll an attacker-controlled device can let an impostor pass authentication.
• Recovery, re-enrollment, device replacement, and privileged-access elevation need strong identity verification.
• Phishing, SIM swapping, session theft, and account recovery attacks can undermine authentication controls.
• Phishing-resistant MFA does not address every risk if authenticator binding or recovery processes are weak.
• A session can be hijacked or an identity compromised after a legitimate MFA login, so identity risk must be monitored over time.
• The article recommends reassessing identity confidence based on signals such as device changes, unusual access, privilege escalation, and recovery events.