How MFA and password managers limit the damage

The final layer of defence assumes the worst: an attack got through and your password is gone. Two everyday tools decide how bad that actually is.

Multi-factor authentication

MFA requires something extra beyond your password, such as an authenticator app prompt, a code, or a physical security key. With MFA enabled, a phished password is no longer enough on its own, and a large share of account takeover attempts simply fail at that point. That is why the NCSC recommends MFA on every account that offers it, and why your important accounts, email above all, should have it switched on.

MFA is a safety net, not a force field. As Section 3 covered, attackers use MFA fatigue and fake support calls to trick people into approving logins, and some phishing pages proxy codes in real time. So the habits still matter: never approve a prompt you did not trigger, never read a code to anyone over the phone, and prefer stronger methods like number matching or physical keys where offered. Even so, imperfect MFA beats no MFA by a wide margin.

Password managers

A password manager generates and stores a strong, unique password for every account. This limits phishing damage in two distinct ways.

First, unique passwords contain the blast radius. If one account's password is phished or leaked, it opens exactly one door. Attackers routinely take credentials stolen from one site and try them everywhere else, an attack called credential stuffing, and password reuse is what makes it work.

Second, and less obvious: a password manager is a phishing detector. It offers to fill your password based on the site's actual address, not its appearance. On the genuine site, autofill works. On a lookalike domain, however perfect the page looks, the manager stays silent, because to it, yourbank-secure.com and yourbank.co.uk are simply different sites. If your password manager unexpectedly refuses to fill a login page, stop and check the address, because that is exactly the behaviour a phishing site produces.

The complete picture

Put the course together and it forms one system. Recognise the manipulation, verify through known channels, and when something gets through anyway, report fast without fear, with MFA and unique passwords making sure a single mistake stays small. No single layer is perfect. Together, they are what a resilient organisation looks like.