Multi-Factor Authentication (MFA)

Multi-factor authentication (MFA) is a login method that requires two or more independent proofs of identity before granting access. The factors come from different categories: something you know (a password or PIN), something you have (a phone, hardware key, or authenticator app), and something you are (a fingerprint or face scan). Because the factors are independent, an attacker who steals one — almost always the password — still cannot get in without the second.

How it works

After a user enters their password, the service demands a second proof: a one-time code from an authenticator app, a push notification to approve, a code sent by SMS, a hardware security key touch, or a biometric check. Not all second factors are equal. SMS codes can be intercepted through SIM swapping, and one-time codes can be relayed in real time by adversary-in-the-middle phishing kits. Push notifications resist those attacks but introduced a new one — MFA fatigue, where attackers bomb a user with approval prompts until one gets accepted. Phishing-resistant methods such as FIDO2 security keys and passkeys bind the login cryptographically to the legitimate site, closing the relay hole entirely.

How to defend with it

Enable MFA everywhere, but prioritize by risk: email, identity providers, VPN and remote access, admin consoles, and finance systems first, since these are the accounts credential stuffing and password-reuse attacks target. Prefer app-based or, better, phishing-resistant factors over SMS, and use number matching instead of simple push approval to blunt fatigue attacks. Critically, MFA shifts rather than eliminates human risk: employees must know that an unexpected prompt means someone has their password, and that approving it — or reading a code to a "help desk" caller — hands the account over. Training and simulation around these scenarios is what turns MFA from a checkbox into a working control.