No Link to Click: How a Text and a Phone Call Defeated MFA
No link was clicked. No malware was installed. No email gateway was crossed. A software development director lost her account in under two minutes. This is the full chain, in real time: a text message that offers to prevent a problem rather than asking for anything, a phone number she dials herself, a calm voice that explains what she is about to see before she sees it, and six digits read out loud.