MFA (Multi-Factor Authentication)
A sign-in method that requires two or more proofs of identity of different types, such as a password plus a key or code, so a stolen password is not enough.
Pronunciation
What it is
Multi-factor authentication (MFA) requires at least two factors of different types to confirm that whoever signs in is who they claim to be:
| Factor | What it is | Examples |
|---|---|---|
| Something you know | A secret | Password, PIN |
| Something you have | An object in your possession | Phone with an authenticator app, physical security key, smart card |
| Something you are | A biometric trait | Fingerprint, face recognition |
Two passwords are not MFA: they are two factors of the same type. Two-step verification (2FA) is the most common form of MFA, with exactly two factors.
Why it matters
Most account attacks start with a leaked, guessed or phished password. With MFA, that password alone no longer opens the door. In 2019 Microsoft reported that MFA can block more than 99.9% of the account compromise attacks it observed.
Not every second factor protects the same
| Method | Level | Why |
|---|---|---|
| SMS code | Low | Can be intercepted or redirected through a fraudulent SIM change (SIM swapping). NIST treats it as a restricted authenticator |
| Authenticator app code (TOTP) | Medium | Does not travel over the phone network, but a fake site can ask for it and replay it in real time |
| Push notification (“Is this you?”) | Medium | Vulnerable to MFA fatigue: the attacker sends requests until someone approves out of tiredness. Better with number matching |
| FIDO2 / WebAuthn key or passkeys | High | Phishing-resistant: the key only answers the legitimate domain, so a fake site gets nothing useful |
CISA recommends phishing-resistant MFA (FIDO2/WebAuthn or PKI) for privileged accounts and critical systems.
Where a company should start
- Email and cloud accounts (Microsoft 365, Google Workspace): the most attacked entry point.
- Remote access and VPN, and admin panels.
- Privileged accounts: administrators, finance and whoever approves payments, with physical keys or passkeys.
- Vendors with access to your systems: require MFA from them too.
- Recovery codes stored safely, so nobody is locked out after losing a phone.
Demo example: a company turns on MFA for everyone’s email and physical keys only for its 5 administrators. A phishing email that steals a user’s password is no longer enough to get into their mailbox.
Common mistakes
- ❌ Enabling it only for a few “important” users: the attacker gets in through the account without MFA.
- ❌ Leaving SMS as the only option for critical accounts.
- ❌ Approving notifications you did not request. If one arrives without you trying to sign in, someone has your password: change it and report it.
Related terms
- Phishing - The attack that phishing-resistant MFA neutralizes
- Zero Trust - A model where every access is verified, with MFA as a core piece
- Ransomware - Many attacks start with credentials that had no MFA
- JWT - Token many applications issue after authentication
Official resources: