Understanding MFA bypass

This report outlines MFA fundamentals (something you know, have, are) and examines common bypass methods including social engineering and guessing, biometric spoofing, push-notification fatigue, SIM swapping to intercept SMS codes, token theft and adversary-in-the-middle attacks against authenticator workflows, and RFID/NFC badge cloning; it concludes with mitigations such as user training, avoiding weak security questions and easily guessed PINs, enabling carrier account-change alerts, limiting social media exposure, using HTTPS, and verifying certificates.