Educating Users About 'Phishable' Multifactor Authentication The only way one can truly mitigate risks associated with phishable MFA is by training users to identify phishing scams for what they are, whether they arrive via email, text or phone.