What Multi-Factor Authentication Is

Multi-factor authentication (MFA) requires more than just a password to sign in — typically a password plus a second, independent factor such as a code from an app, a physical security key, or a biometric check. The idea is that even if a password is stolen or guessed, an attacker still can't get in without also controlling the second factor.

The Three Categories of Authentication Factors

  • Something you know — a password or PIN.
  • Something you have — a phone, authenticator app, or physical security key.
  • Something you are — a fingerprint, face scan, or other biometric.

True multi-factor authentication combines factors from at least two different categories. Two passwords, for example, would not count as multi-factor, since both come from the 'something you know' category.

Common Types of Second Factors

SMS or Text Message Codes

A one-time code sent by text message is widely supported and easy to use, but it's also considered the weakest common option, since it can be intercepted through techniques like SIM-swapping, where an attacker convinces a carrier to transfer a phone number to a device they control.

Authenticator Apps

Apps that generate time-based codes locally on a device, without relying on a text message, are generally more secure than SMS since they aren't vulnerable to SIM-swapping. They do require the device with the app installed to be available at sign-in.

Push Notifications

Some services send a prompt to a registered device asking to approve or deny a sign-in attempt. This is convenient, though it's important to deny any prompt that wasn't actually requested, since 'MFA fatigue' attacks rely on people approving prompts out of habit.

Physical Security Keys

A small hardware device plugged into a USB port or tapped via NFC provides one of the strongest available forms of MFA, since it's resistant to phishing in a way that codes typed into a fake page are not.

Why MFA Matters Even With a Strong Password

Passwords can be exposed through data breaches, phishing, or malware regardless of how strong they are individually. MFA adds a layer that isn't compromised just because a password leaks, which is why security guidance consistently recommends it as one of the single most effective steps an individual can take to protect an account.

Where to Turn MFA On First

Prioritizing email, banking, and any account used to recover other accounts makes sense, since compromising an email account often allows an attacker to reset passwords elsewhere. Most major services provide MFA setup within account security settings, often under a heading like 'two-step verification' or 'two-factor authentication.'