Add a second factor to authentication for all sensitive accounts. Options in order of security:

• Hardware security keys (FIDO2/WebAuthn) — phishing-resistant, highest security

• Authenticator app (TOTP) — time-based one-time passwords (Google Authenticator, Authy)

• Push notifications — approve/deny login on a registered device

• SMS OTP — better than nothing, but SIM-swappable; avoid for high-security contexts

Also apply MFA to the MFA recovery flows — backup codes and account recovery are common bypass targets.

Credential stuffing works because the attacker has the correct username and password. MFA adds a factor the attacker doesn't have — a physical device, a time-based code. Even a perfectly valid password isn't enough to get in.

MFA can be bypassed via real-time phishing (attacker proxies the MFA code between victim and server), SIM swapping (for SMS), and social engineering account recovery. MFA raises the bar dramatically but isn't impenetrable.