Authentication & Access Scams
Fraudsters are constantly evolving their tactics to bypass security measures, and authentication scams have become one of their most effective tools. These scams exploit trust and urgency to trick individuals into approving fraudulent access requests or sharing sensitive information. Understanding how these attacks work—and how to respond—can help protect your accounts and keep your data secure.
What is Multi-Factor Authentication (MFA)?
MFA, sometimes known as two-factor authentication, is a way of strengthening the security of your online accounts with an additional layer of protection. It works by requesting that an individual verifies their identity with two separate factors: for example, a password and a one-time code.
The main advantage of using MFA is that even if a criminal manages to obtain a password, they will still require a second means of authentication which only the legitimate account holder can approve. However, scammers are now shifting their approach—they look to steal someone’s credentials and attempt to bypass this security measure by tricking them into providing their one-time passcode or approving fraudulent requests.
Common Authentication Scams and How to Avoid Them
Fraudsters impersonate trusted brands, like Microsoft, to encourage individuals to accept authentication requests or share one-time passcodes.
How to avoid becoming a victim:
- Only approve authentication requests you initiated.
- Check the context: If you weren’t logging in or performing an action that requires authentication, treat the request as suspicious.
- Never share codes or passcodes, legitimate services and IT teams will never ask for these.
- Report suspicious activity immediately.
MFA Bombing or MFA Fatigue attacks are a social engineering technique which involves repeatedly pushing login requests (second-factor authentication) to the target victim’s email, phone, or registered devices.
How to avoid becoming a victim:
- Ask yourself: Was I expecting this authentication request?
- If you were not trying to log in, do not approve the request.
- Report suspicious activity immediately.
Another strategy fraudsters use is by pretending to be a trusted individual such as an IT helpdesk employee. Posing as an IT support worker creates a false sense of authority to gain an individual’s trust.
How to avoid becoming a victim:
- Be wary of unsolicited contact claiming to be from IT.
- Verify the identity of the person requesting information.
- Never share passwords or passcodes—legitimate IT support will never ask for these.
- If you believe an account has been compromised, report it immediately
For more tips on how to protect your business from cyber threats, visit our webpage on cybersecurity.
