Short answer: Yes, 2FA can be bypassed — but almost never by breaking the cryptography. Attackers get past it by relaying codes through fake login pages in real time, stealing your session cookie after you have already logged in, hijacking your phone number, wearing you down with approval prompts, or talking a support agent into resetting it. Only phishing-resistant methods — passkeys and hardware security keys — close the biggest of these holes.
None of this is a reason to skip 2FA. An account with two-factor authentication is dramatically harder to steal than one without. But knowing how it fails tells you which method to choose and which warning signs to act on.
1. Real-time phishing (adversary-in-the-middle)
This is the big one, and it defeats every code-based method: SMS, TOTP, and push approvals alike.
The attacker sends you to a page that looks exactly like the real login screen but sits between you and the genuine site. You type your password — it is forwarded to the real site instantly. The real site asks for your six-digit code, the fake page asks you for it, you type it, and it is relayed within the 30-second window. You are logged in. So is the attacker, holding a valid session.
Toolkits that automate this have been freely available for years, which is why “I have 2FA so phishing can’t hurt me” is no longer true.
What actually stops it: passkeys and hardware security keys. Both are bound to the real site’s domain by the browser, so they simply refuse to authenticate on a lookalike domain — the human doesn’t have to spot the fake. See passkeys vs 2FA and YubiKey vs passkeys.
2. Session cookie theft
Once you have logged in, the site issues a session cookie that says “this browser is already authenticated.” Steal that cookie and you skip the login entirely — password and second factor both irrelevant.
Infostealer malware does exactly this, harvesting cookies from browsers on infected machines and selling them in bulk. It is how a great many “but I had 2FA on!” account takeovers actually happened. Discord, gaming and social accounts are heavily targeted this way.
What helps: not running cracked software or random downloads, keeping your OS and browser patched, and signing out of all sessions if you suspect infection. Changing your password invalidates active sessions on most well-built services.
3. SIM swapping
If SMS is enabled as a method, your account is only as secure as your mobile carrier’s customer service desk. An attacker with some personal details persuades the carrier to move your number to their SIM, then receives every code you would have received.
The full mechanics and defences are in our guide to SIM swap attacks, but the short version is: add a port-out PIN with your carrier, and remove SMS as a 2FA method wherever an app is available. Remember that your account’s security is set by the weakest method you leave enabled — an authenticator app is pointless if SMS is still switched on as a fallback.
4. MFA fatigue and prompt bombing
With push-based 2FA, the attacker who already has your password just requests login over and over. Your phone fills with approval prompts at 3am. Eventually someone taps Approve to make it stop, or taps it half-asleep by mistake.
Several very large corporate breaches started exactly here. The defence is number matching — the login screen shows a two-digit number you must type into the app, so a blind tap cannot approve anything. Our post on push notification 2FA and prompt bombing covers how to check whether your provider uses it.
The rule: if you get an approval prompt you did not trigger, your password is already compromised. Deny it and change the password immediately — the prompt itself is the alert.
5. Social engineering of account recovery
Why break 2FA when you can ask support to remove it? Attackers impersonate the account holder, produce a plausible story and some public personal data, and request a reset. Consumer platforms with high support volume are the softest targets.
You cannot fully control this one, but you can reduce your exposure: keep your recovery email itself protected with strong 2FA, avoid publishing your date of birth and address, and where a service offers “advanced protection” programmes that disable phone-based recovery, consider using them.
6. Malware on the device itself
If the phone running your authenticator is compromised, the game is over — screen-reading malware, notification interception and overlay attacks can capture codes as they appear. Android banking trojans have done this for years.
What helps: install apps only from official stores, refuse accessibility-service permission requests from anything that is not an accessibility tool, and keep the device updated. Also worth noting: this is the argument for not keeping passwords and TOTP codes on the same compromised device — discussed in password managers with built-in TOTP.
7. Stolen backup codes and exposed secret keys
The least sophisticated attack, and one of the most common. Backup codes screenshotted into a cloud photo library. The setup QR code saved “just in case.” Recovery codes pasted into an email draft or a note synced to an account protected by the same password.
Anyone who obtains your original setup QR code can generate your codes forever, silently, without you noticing anything at all. Our guide to storing 2FA backup codes safely ranks the sensible options.
So what should you actually do?
In order of impact:
- Use passkeys or a hardware key on your most important accounts — email first, because email resets everything else.
- Use an authenticator app, not SMS, everywhere passkeys are not offered. Most banks and exchanges are still in this category.
- Remove SMS as a fallback once the app works.
- Never type a code into a page you arrived at from a link. Navigate to the site yourself. This single habit defeats attack #1.
- Treat unexpected prompts and codes as alarms, not annoyances.
- Store backup codes offline and never screenshot a setup QR.
Frequently asked questions
Can someone hack my authenticator app itself?
Not remotely, in any practical sense. TOTP codes are computed offline from a secret stored on your device — there is nothing to intercept over the network. The realistic risks are device malware, someone with physical access to an unlocked phone, or a leaked setup QR code. See how TOTP codes work.
Is 2FA still worth it if it can be bypassed?
Absolutely. Every bypass above requires targeted effort. Accounts without 2FA fall to fully automated credential stuffing at massive scale — a bot trying leaked passwords across thousands of sites. 2FA removes you from that pool entirely.
Which 2FA method is the hardest to hack?
A hardware security key, followed by device-bound passkeys. Both are phishing-resistant by design. TOTP apps come next, then push with number matching, then push without it, and SMS last.
Can a hacker get past 2FA with just my password?
Not directly — but a password alone lets them trigger prompt bombing, and it is the first half of every real-time phishing attack. If you learn your password has leaked, change it even though 2FA is enabled.
How do I know if my 2FA has been bypassed?
Watch for login alerts from unfamiliar locations, codes or prompts you did not request, security emails about changed recovery details, and sessions you do not recognise. Most services have a “where you’re logged in” page — check it occasionally and end anything unfamiliar.
Does a VPN protect my 2FA?
No. A VPN encrypts your network traffic, which is not where any of these attacks happen. It will not stop phishing, cookie theft, SIM swapping or prompt bombing.
The bottom line
2FA is not a magic shield, it is a filter — and it removes you from the enormous pool of accounts that fall to automated attacks. The remaining gaps are mostly about tricking the human, not breaking the maths. Move your critical accounts to passkeys or a security key, keep an authenticator app for everything else, and get suspicious the moment a code arrives that you did not ask for.
New to all of this? Start with our complete guide to two-factor authentication, then set it up on your Google account first.
4 Responses