Multi-factor authentication (MFA) has become one of cybersecurity’s most important controls. Roughly 70% of enterprise workforce users are now protected by it. But its success has created an unintended problem. Organizations increasingly treat successful authentication as proof of identity.
They assume that because someone passed MFA, they have verified who that person is. They may also assume that the identity itself has not been compromised.
Neither is it necessarily true.
Attackers increasingly target the processes surrounding authentication. These include enrollment, account recovery, help desks, device registration, and session management. An attacker may bind an authenticator to the wrong person or hijack an authenticated session. In either case, MFA may work exactly as designed while granting access to an impostor.
The question therefore needs to evolve from “Did this user pass MFA?” to “How confident are we that this is still the legitimate person behind the identity?”
Authentication Is Not Identity Verification
Authentication establishes that someone controls the authenticators associated with an account. Identity verification, or identity proofing, establishes whether that person corresponds to the claimed real-world identity.
The NIST Digital Identity Guidelines explicitly distinguish the two.
Suppose an attacker social-engineers a help desk into resetting an employee’s MFA and then enrolls a device under the attacker’s control. The next login may satisfy every authentication requirement. The credentials are correct, and the registered second factor is successfully completed.
The authentication succeeded. The identity assurance failed.
This is why identity verification matters during password resets, MFA re-enrollment, account recovery, device replacement, and privileged-access elevation. Weak verification at any of these points can turn MFA into part of the attacker’s infrastructure.