Fraudsters are experts at adapting to their environment. As businesses implement more sophisticated fraud prevention measures, cybercriminals are constantly looking to outsmart and outmaneuver them. To combat this, more companies are using stronger user authentication methods, such as multi-factor authentication (MFA), to verify their legitimate customers and keep fraudsters at bay.
MFA adds an extra layer of security, such as the use of one-time passwords (OTP), to verify the identity of users. However, account takeover (ATO) attacks can bypass MFA with OTP bots, SIM swapping, MFA prompt bombing, adversary-in-the-middle (AiTM) phishing, and help desk social engineering. Even if MFA were 100% effective, it creates friction with users, which can stall sales and slow growth.
Account takeover attacks (ATO) are a type of cyberattack that results in the unauthorized access of an account, typically through the use of stolen credentials. Once an account has been compromised, it may be used to launch additional attacks, make fraudulent purchases or transactions, or steal valuable information. In Sift’s Q1 2026 Digital Trust Index, 21% of U.S. consumers surveyed said they experienced an account takeover in the past year.
In this blog, we will explain five methods fraudsters who perpetrate ATO attacks use to bypass MFA and how businesses can protect themselves.
What is a one-time password (OTP) bot?
One-time password (OTP) bots are an automated fraud service used during ATO attacks to target victims with fake phone calls and SMS messages. These OTP bots use social engineering techniques to trick victims into reading out or entering the one-time passwords sent to their phones. The fraudster already has the victim’s login details, so the code is the last step between them and the account.
What is SIM-swapping?
Another tactic is subscriber identity module (SIM)-swapping, which is an advanced account takeover (ATO) attack technique that intercepts one-time passwords (OTPs) by temporarily gaining control of a victim’s phone number to receive calls and texts. SIM-swapping uses social engineering to convince the victim’s mobile phone company to transfer the line to a different SIM card.
For example, fraudsters may pretend to be a user locked out of their account or a mobile phone employee trying to help someone in the store. Attackers have even been known to bribe employees to gain this access. Port-out fraud, where the number is moved to a different carrier, and eSIM transfers follow the same playbook.
What is MFA prompt bombing?
MFA prompt bombing is an account takeover (ATO) attack technique that uses social engineering to trick a user into unwittingly granting access to a malicious authentication attempt. These attacks seek to frustrate their targets into accidentally accepting the push notifications of MFA apps by sending them when they are most distracted.
For example, an attacker may repeatedly send an MFA push notification in the middle of the night, until their target finally accepts the prompt so they can fall back asleep. Some apps now ask users to type in a number shown on the login screen, which makes blind approvals harder, but a tired or rattled user can still be talked into approving a request.
What is adversary-in-the-middle (AiTM) phishing?
Adversary-in-the-middle (AiTM) phishing is the method that defeats the most common forms of MFA, including SMS codes, authenticator app codes, and push approvals. The fraudster sends the victim to a login page that relays everything to the real service in real time. The victim enters a password, completes the MFA challenge, and logs in as usual. Meanwhile, the fraudster captures the authenticated session cookie the service issues at the end, according to the Cloud Security Alliance. With that cookie, the fraudster is already logged in and never needs the password or a code again.
These tools are cheap and easy to get. Researchers at Lexfo are tracking three phishing kits built on the open-source Evilginx framework that proxy live Microsoft 365 sessions and capture session cookies and OAuth tokens. The kits also use AI to write personalized lures, and the researchers concluded that defenders should assume attackers of any skill level can bypass MFA this way. Infostealer malware reaches the same result from a different direction by lifting session cookies straight off an infected device.
What is help desk social engineering?
Help desk social engineering skips the technology and goes after the process around it. Fraudsters pose as executives, employees, or contractors and push the urgency of a request to get a support agent to change an account’s MFA method, enroll a new device, or run an account recovery. If the agent agrees, the fraudster controls the account’s MFA, as Persona describes. The same applies to customer accounts: any “lost my phone” or “forgot my password” flow that is easier than logging in becomes the way in.
Once an account is compromised, fraudsters can disable security settings (e.g., MFA), reset passwords, and change account information (e.g., email address). Fraudsters can then use these compromised accounts (or sell them on the dark web) to make unauthorized purchases and transfers or conduct additional attacks.
How to prevent account takeover attacks (ATO)
Preventing account takeover (ATO) attacks requires multiple layers of defense since multi-factor authentication (MFA) can be bypassed by fraudsters. Phishing-resistant authentication, such as passkeys and FIDO2 security keys, shuts down AiTM relays because the login response is tied to the real site’s domain and cannot be passed through a proxy, the Cloud Security Alliance notes. Device intelligence, IP address analysis, behavioral analytics, high-risk activity monitoring, session monitoring, and SIM swap detection can also prevent ATO. Account recovery and MFA reset flows need the same scrutiny as login, since fraudsters will go after whichever path is weakest.
The democratization of fraud, such as the sale of OTP bots on dark web forums, has lowered the barriers of entry for non-technical attackers. The automation of ATO has enabled it to grow at a much faster rate than manual fraud reviews can keep pace. Furthermore, many businesses are reluctant to require MFA because it is a source of customer friction that can slow sales and growth. Customers may be more open to the extra step than those businesses assume: 93% of consumers in Sift’s Q1 2026 Digital Trust Index survey said they would accept additional verification at login or checkout if it helps reduce fraud.
Sift’s Account Defense is an automated fraud management solution that prevents ATO. More than one trillion events a year from the Sift global data network power its AI-enabled approach. Device intelligence detects unfamiliar devices that are indicative of ATO. Behavioral analytics alert fraud prevention teams to high-risk account activity. Because MFA can be required only when the Sift Score signals risk, organizations can customize the solution according to their risk tolerance.
With Sift, the end result is that businesses can prevent and detect ATO, with or without MFA.
Visit our Fraud Intelligence Center to discover more fraud schemes.
