Can a fake login page get around MFA?

Yes, that can work. It's often called adversary-in-the-middle phishing. The fake site relays the login between the person and the real service, so a one-time code or push approval can authenticate the attacker's session too.

Even number matching can be relayed if the fake page shows the number from the real prompt. The attacker may then capture the authenticated session cookie. MFA still helps when someone has only stolen your password, but not every MFA method can tell a genuine login from a relayed one.

Passkeys and security keys using FIDO2 or WebAuthn are designed for this problem. The browser checks the real site's origin as part of authentication, so a fake site on a different domain can't simply relay the challenge and use your credential as if it were the real site.

That protects the login flow against this kind of phishing. It doesn't make a compromised device or a stolen session harmless, so calling it impossible to attack would be too broad.

For an organization, access policies can add another hurdle. Requiring a managed, compliant device or restricting access by network location can limit where a stolen credential or session can be used. Token protection may also help for services that support it.

Those controls need configuring around the actual apps and devices in use. They can also mean people can't sign in from a personal computer or phone.

Training and email filtering still have a role. Catching a suspicious link before someone reaches the fake page avoids the whole flow, although neither filtering nor asking people to spot every fake is foolproof.