The basic idea
A password alone is a single point of failure. If someone learns it, whether through a data breach, a fake website or a lucky guess, they can sign in as you. Multi-factor authentication, usually abbreviated MFA, asks for more than one kind of proof, so that a stolen password is not enough on its own.
The key word is “kind.” Using two passwords is not multi-factor, because both are the same type of proof. Real multi-factor sign-in combines different categories.
The three classic factors
Authentication factors are traditionally grouped into three categories.
- Something you know. A password, a PIN or an answer to a security question.
- Something you have. A phone that receives a code, an authenticator app, a smart card or a physical security key.
- Something you are. A fingerprint, a face scan or another trait, covered in more detail under biometric authentication.
Some descriptions add less common factors such as location or the device being used, which are better thought of as context that can adjust how much checking is needed.
A typical MFA login asks for a password (known), then a code from an app on your phone (have). An attacker would need both.
Common second-factor methods
Text message codes. A short code is sent to your phone number. This is familiar and needs no special app, but it is generally considered the weakest of the common options, for reasons covered below.
Authenticator app codes. An app generates a code that changes every short period, using a secret shared once with the service. The codes are produced on the device and do not travel over the phone network.
Push approvals. The service sends a notification to an app, and you tap approve or deny. This is convenient but has its own weakness, described below.
Hardware security keys. A small physical device that you plug in or tap. Many are designed so that they respond only to the genuine website, which makes them resistant to fake sites.
Biometrics on a device. Often used to unlock a stored credential locally rather than being sent to the service.
Backup codes. One-time codes meant for emergencies. They need to be stored carefully, as anyone who finds them can use them.
Why MFA helps
Many account takeovers begin with a reused or stolen password. Because a second factor must be obtained separately, MFA can block many routine attempts, such as someone trying passwords exposed in an unrelated breach. For this reason, security guidance from many organizations commonly encourages turning it on, especially for email, financial and administrator accounts. Using a password manager alongside it addresses a different part of the problem: choosing strong, unique passwords.
MFA does not make an account impossible to compromise. Understanding where it falls short helps people choose better methods and avoid false confidence.
Where it falls short
Phishing in real time. A fake sign-in page can ask for your password and then for your code, and pass both to the real site immediately. The code is valid, so the attacker gets in. Deceptive messages of this kind are discussed in the context of phishing scams. Methods that check which website is asking, such as hardware keys and passkey sign-in, are designed to resist this.
Push fatigue. If an attacker has your password, they can trigger repeated approval requests, hoping you will tap approve just to make them stop, or by mistake. Some systems reduce this by asking you to enter a number shown on the login screen.
SIM swapping and number takeover. Text codes depend on control of a phone number. An attacker who convinces a carrier to move a number to another SIM, or who intercepts messages, may receive the codes. This is one reason text messages are treated as a weaker factor.
Social engineering. An attacker may phone a victim pretending to be support and ask them to read out a code. This is a standard tactic described under social engineering, and no technology prevents a person from being persuaded.
Stolen sessions. After a successful login, a website usually stores a token so you stay signed in. Malware on your device may steal that token and use it without needing any factor at all.
Weak recovery paths. If a locked-out user can reset everything with an easy question or a call to a help desk, an attacker may use that route instead of the protected login. Recovery is often the weakest link.
Lost or broken devices. A lost phone can lock a legitimate user out. If backup options were not set up beforehand, recovery can be slow and stressful.
Incomplete coverage. MFA protects only the accounts and services where it is switched on. Older systems, shared accounts and service accounts sometimes cannot use it.
Choosing sensibly
Rather than treating MFA as on or off, it helps to think in degrees.
- Any second factor is generally better than none for important accounts.
- App-based codes are typically stronger than text messages.
- Hardware keys and passkeys are generally regarded as the most resistant to phishing, though they require some setup and a plan for lost devices.
- Keep recovery options current and stored safely.
- Be suspicious of unexpected prompts. An approval request you did not trigger is a signal that someone may have your password.
For organizations, MFA is normally one component of identity and access management and is often paired with single sign-on so that people face fewer prompts. Rolling it out well involves usability, support for people who lose devices, and training; the awareness side is discussed under security awareness training.
A realistic view
MFA raises the effort required to take over an account, and that is valuable. It does not remove the need for sensible habits, updated software and careful handling of unexpected messages. Outcomes depend on the method chosen and how it is implemented.
This article is general information, not security advice for any specific situation. Organizations with particular requirements should consult qualified security professionals.