Beyond MFA: Building a User-Centric Authentication Strategy That Stops Attacks