Account Recovery Processes Emerge as a Primary Attack Vector Against MFA

MFA's Effectiveness and New Attack Paths

Multi-factor authentication (MFA) has strengthened account security by adding a second factor to password-based authentication. This has made it more difficult for attackers to compromise accounts even if they obtain user credentials. Organizations are also moving towards stronger MFA methods like authenticator apps, FIDO security keys, and passkeys, further enhancing protection against credential theft.

The Rise of Account Recovery as an Attack Vector

Because MFA has made direct attacks less effective, attackers are now seeking alternative routes, with account recovery processes becoming a common target. Instead of trying to steal a user's second factor, attackers aim to convince those with management rights to replace it. This strategy exploits the necessary procedures for legitimate users to regain access to their accounts when they lose devices or forget credentials.

Service Desk as a Security Boundary

The shift in attack focus elevates the service desk from a mere support function to a critical component of an organization's identity security boundary. The security of an account during recovery often depends less on the MFA technology in place and more on the robustness and security of the process used to reset or recover access. Verizon's Data Breach Investigation Report indicates that stolen credentials are involved in 44.7% of breaches, highlighting the importance of securing all aspects of authentication, including recovery.