Limits of MFA

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A caller says they are from your bank and asks you to read out the 6-digit code just texted to you. What should you do?

A Read the code out because they work for the bank

B Hang up and never share the code

2. Your phone buzzes with a login approval prompt, but you did not try to log in. What should you do?

A Tap approve to make the buzzing stop

B Deny the prompt and report it

3. True or false: MFA makes an account impossible to break into.

A False. A tricked user can still hand over the second factor

B True. MFA can never be beaten

4. Which is an example of MFA fatigue?

A A scammer sends lots of login prompts hoping you approve one

B You get one prompt after you log in yourself

5. A message says: 'Reply with the code we just sent you to keep your account.' Which choice is safest?

A Ignore the message and do not share the code

B Reply quickly with the code so you do not lose your account

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Scammer: "Read me the code we just texted you."		AAn unexpected MFA prompt that you should deny and report, not approve.
2Prompt: "Approve sign-in?" (you did not log in)		BA scammer tricking you into handing over your MFA code so they can log in as you.
3MFA fatigue: a scammer spams prompts hoping you tap Approve just to make them stop		C10 prompts at midnight -> tap Approve to stop them
4The safe response to a prompt or code request you did not start		DMFA codes must never be shared with anyone, even someone who claims to be from a bank or company. Real staff never ask for them.
5"My MFA code is private, but I'll tell the helpful 'bank worker' who rang me."		EApproving a prompt you did not start lets a scammer in. You should deny it, change your password and report it.
6"I got an unexpected sign-in prompt, so I'll tap Approve and ignore it."		FDeny the prompt, never share the code, report it

Definitions

MFA fatigue

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF unexpectedPrompt THEN ____ prompt

IF scammerAsksForCode THEN shareCode ← _____

IF unexpectedPrompt THEN DENY prompt ______ prompt

IF ___ loginStartedByMe THEN DENY prompt

IF passwordStolen ___ codeShared THEN accountAtRisk ← true

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A IF caller asks for my code

B read the code to the caller

C hang up the call

Question 2

A IF a prompt was not me

B APPROVE the prompt

C CHANGE my password

Question 3

A prompt_count <- 8

B login_started <- TRUE

C approve <- login_started

Question 4

A FUNCTION handle_prompt(mine)

B IF mine = TRUE THEN

C approve

D ELSE approve to stop spam

Question 5

A code <- 483921

B scammer_asks <- TRUE

C share_code <- TRUE

D PRINT share_code

Answer Key

Limits of MFA

Section A: Quick Questions

B — Hang up and never share the code

B — Deny the prompt and report it

A — False. A tricked user can still hand over the second factor

A — A scammer sends lots of login prompts hoping you approve one

A — Ignore the message and do not share the code

Section B: Match the Pairs

Scammer: "Read me the code we just texted you." → A scammer tricking you into handing over your MFA code so they can log in as you.

Prompt: "Approve sign-in?" (you did not log in) → An unexpected MFA prompt that you should deny and report, not approve.

MFA fatigue: a scammer spams prompts hoping you tap Approve just to make them stop → 10 prompts at midnight -> tap Approve to stop them

The safe response to a prompt or code request you did not start → Deny the prompt, never share the code, report it

"My MFA code is private, but I'll tell the helpful 'bank worker' who rang me." → MFA codes must never be shared with anyone, even someone who claims to be from a bank or company. Real staff never ask for them.

"I got an unexpected sign-in prompt, so I'll tap Approve and ignore it." → Approving a prompt you did not start lets a scammer in. You should deny it, change your password and report it.

Section C: Definitions

MFA fatigue — A trick where a scammer spams you with login prompts hoping you approve one, or talks you into sharing your code. Never share codes, never approve prompts you didn't start, and report them.

Section D: Fill in the Blanks

IF unexpectedPrompt THEN
  DENY prompt

IF scammerAsksForCode THEN
  shareCode ← false

IF unexpectedPrompt THEN
  DENY prompt
  REPORT prompt

IF NOT loginStartedByMe THEN
  DENY prompt

IF passwordStolen AND codeShared THEN
  accountAtRisk ← true

Section E: Spot the Error

B — Scammers use a stolen password and then ask you for the MFA code. Never share a code with anyone. The line should be 'keep the code secret'.

B — If you did not start the login, someone else is trying to get in. Approving lets them in. The line should be 'DENY the prompt'.

B — The student did not start a login, so login_started must be FALSE. Setting it to TRUE would make approve TRUE and approve a scammer's prompt.

D — Scammers send many prompts hoping you give in and approve one (MFA fatigue). A prompt you did not start should be denied and reported, not approved.

C — Even when a scammer asks for the code, it must never be shared. share_code should be FALSE.