Blog By

Angela Violet,

Cybersecurity & IT Risks Associate (CITRA) 

South-End Tech Limited

Date: Monday,19^th February 2024

Multi-factor authentication (MFA) is an important defense mechanism in a world where digital security is paramount. MFA provides an additional layer of protection by requiring users to provide multiple forms of identification before allowing access to sensitive information. However, even the most advanced security measures can leave you vulnerable to a subtle but powerful threat, social engineering.

 Multi-Factor Authentication:

 Before delving into the field of social engineering, it’s important to understand the importance of multi-factor authentication.

MFA typically involves a combination of two or more authentication factors, such as: For example, something you know (your password), something you have (a token or mobile device), or something you are (biometric data). The purpose of this powerful combination is to enhance security and prevent unauthorized access.

Social Engineering Techniques:

Social engineering is the psychological manipulation of people into divulging sensitive information or taking actions that may compromise security. Hackers skilled in social engineering exploit human psychology rather than relying on technical vulnerabilities.

i. Phishing Attacks:

Common social engineering tactics include phishing attacks. Hackers create fraudulent emails, messages, or websites that mimic legitimate platforms to trick users into revealing their login credentials. Once an attacker obtains the credentials, they can attempt to access the user’s accounts, including those protected by MFA.

ii. Impersonation:

Hackers can impersonate trusted entities, such as: colleagues, technical support staff, and even friends. By gaining the victim’s trust, sensitive information such as MFA codes and credentials can be extracted under false pretenses.

iii. Pretexting:

Pretexting is the process of creating hypothetical scenarios to extract information from a target. For example, a hacker may pose as a colleague facing a technical issue and request his MFA code to troubleshoot the issue, preying on the victim’s desire to be helpful.

iv. Vishing (Voice Phishing):

Vishing occurs when an attacker uses voice communications to trick people into revealing sensitive information. They can impersonate customer service representatives or colleagues over the phone and extract MFA codes and other authentication data.

 Threat Mitigation:

a. Education and Awareness:

A thorough training program helps users recognize social engineering tactics and be careful when sharing sensitive information. Regular awareness campaigns emphasize the importance of skepticism and scrutiny.

b. Implementing advanced MFA solutions:

Organizations should consider advanced MFA solutions that include adaptive authentication, behavioral analysis, and anomaly detection. These technologies can detect anomalous behavior patterns and trigger additional verification steps.

c. Two-way authentication alerts:

Implementing two-way authentication alerts allows users to stay informed about login attempts to their accounts. If an authentication request appears suspicious, users can take immediate action to protect their account.

Please do not hesitate to contact us for your Cybersecurity and Data Protection Solutions and Service needs on the telephone at +254115867309 +254721864169; +254740196519; +254115867309 or email:

aviolet@southendtech.co.ke, cybersecurity@southendtech.co.ke or

info@southendtech.co.ke