Multi-Factor Authentication (MFA): Effectiveness Against Cyberattacks — A Comprehensive Empirical and Threat-Landscape Review

Abstract

As cyber threat vectors proliferate in sophistication and scale, traditionalsingle-factor authentication (SFA) mechanisms based solely on staticpasswords have proven fundamentally inadequate for protecting enterprisesystems, identity infrastructure, and sensitive user assets. Multi-FactorAuthentication (MFA) has emerged as the cornerstone of contemporaryidentity and access management (IAM) frameworks and Zero Trust Securityarchitectures. This comprehensive review paper systematically analyzes theeffectiveness of Multi-Factor Authentication against diverse cyberattackvectors, including credential stuffing, phishing, adversary-in-the-middle(AiTM) proxies, SIM swapping, and push notification fatigue attacks. Drawing upon empirical telemetry from enterprise security reports, academic literature from 2018 to 2026, and analytical security evaluation frameworks, we evaluate the comparative security profiles of various MFA modalities—ranging from legacy knowledge-based and telecommunication-bound factors (SMS/Voice OTPs) to time-based one-time passwords (TOTP), push notifications, and cryptographic hardware tokens operating underFIDO2/WebAuthn standards. Our analysis reveals that while basic MFAimplementation mitigates up to 98.5% of automated bulk credential stuffingattacks, traditional MFA methods remain vulnerable to modern real-timephishing and token theft campaigns. FIDO2-compliant passwordlesshardware authenticators achieve over 99.9% mitigation efficiency againstadvanced adversary-in-the-middle exploits. Furthermore, this papersynthesizes current research gaps, outlines enterprise implementation tradeoffs between security and usability, and highlights emerging paradigms such as Risk-Based Adaptive MFA and Continuous Biometrics. The findingsprovide actionable insights for security architects, researchers, and policymakers seeking to optimize authentication resilience. KEYWORDS: Multi-Factor Authentication (MFA), Cybersecurity, FIDO2/WebAuthn, Adversary-in-the-Middle (AiTM), Phishing Resilience, Credential Stuffing, Zero Trust Architecture, Biometric Security, Push Fatigue.