MFA is essential for security but it can in some cases be bypassed if a bad actor ‘social engineers’ a bank customer via email or phone to use their valid credentials to login to the bank site and complete fake transactions.