When Enrollment Isn't Enough: How Attackers Trick Users Into MFA Downgrades
Okta, Monday, October 5th, 2026
Okta Threat Intelligence describes how social engineers trick users into dropping phishing-resistant MFA for factors that can be phished.
Okta Threat Intelligence warns that enrolling users in strong authenticators is only part of achieving phishing resistance, because skilled phone-based social engineers target the weakest method on an account.
Okta regularly sees attackers persuade users to swap a phishing-resistant sign-in method for one that can be phished, a technique called MFA downgrade, since phishing-resistant methods cannot authenticate to lookalike domains.
The post shares examples, explains why these authenticators leave no shared secret to steal, and advises requiring phishing-resistant factors only while disabling the ability to switch to weaker ones.