An interesting piece (as Krebs' typically are). There are a number of takeaways here for both users and implementors. The headline one of course is that poor im

An interesting piece (as Krebs' typically are). There are a number of takeaways here for both users and implementors. The headline one of course is that poor implementations of MFA can themselves become a risk factor in a variety of ways. Ideally if a company is going to implement one at all, they need to be really careful about what they're rooting the trust in. If it's required for everybody when the account is created originally, than it can be assumed by definition that the same human who created the account setup the MFA as well. But if it's something that can be added on later, is there any thought to how that fact is established and what recovery procedures are available if it isn't? That's particularly the case when money is involved, and it's also curious in that subcase that the money trail itself isn't more often used as a recovery identifier. Ie., when linking financial accounts a fairly common verification procedure is that a couple of <$1 deposits are made and must be entered. This is a pretty core way to verify that at the least the money is also controlled by the same person, and financial accounts usually have a lot more identity tied to them. It's almost surprising entities the size and sophistication of Microsoft or Google don't do that, because it'd also help reduce the potential financial return for attackers. Want to make core account changes when money is involved? You need to verify you control the money. Attackers could change to their own funding source, but that'd reduce the value of the attack. Of course it also is a reminder to be careful about what money you tie to online accounts at all: >Nevertheless, the thieves began abusing their access to purchase games on Xbox and third-party sites. “During this period, we started realizing that his bank account was being drawn down through purchases of games from Xbox and [Electronic Arts],” Dayman the elder recalled. I would never, ever tie a checking/savings account to basically anywhere online. When the money is pulled out of those it's a huge pain to get back if it's possible at all. Credit cards, even ultra basic low cap starter types for people with no credit history yet, are another layer of protection and intermediation. Virtual card numbers with unique cards per account may sometimes be useful. Even better is to take the convenience hit and leave no stored financial payment at all. Just reenter each time, or get $10/25/50 gift cards and use those to fund a game account as needed for new purchases. >“I pulled the recovery codes for his Xbox account out of the safe, but because the hacker came in and turned on multi-factor, those codes were useless to us.” I think this is bad design by Microsoft. Why should turning on MFA, or adding a new MFA factor, obviate one-time use recovery codes which are to some extent a weak form of MFA themselves and explicitly should serve as a final emergency recovery thing people have in a physical safe? A decent recovery code system itself is typically a requirement for good MFA, as a final resort in case the factors are all lost/damaged. They could also be used as another way to try to meet the issue of verifying the person who created/owns the account is indeed the one turning on MFA.