What is multi-factor authentication and why does it matter?
MFA blocks the vast majority of automated account takeovers, even when your password is already stolen.
Multi-factor authentication (MFA) means proving your identity using at least two independent pieces of evidence before a system lets you in. One factor is usually your password; the second is something only you physically have or are. Because both pieces must be present at login, a stolen password alone is not enough to break in.
What counts as a "factor" in MFA?
A factor is a category of proof, not just a single piece of data. NIST SP 800-63B groups them into three categories: something you know (a password or PIN), something you have (a phone or hardware key), and something you are (a fingerprint or face scan). Using two from the same category, such as two passwords, does not qualify as MFA.
The three categories matter because an attacker who steals your password has only breached the "know" bucket. Adding a "have" factor, like a one-time code sent to your phone or generated by an authenticator app, forces the attacker to also physically control your device.
How does MFA actually work during login?
When you log in, the server completes authentication (proving who you are) in two separate steps. First it checks your password against a stored hash. If that passes, it challenges you for the second factor before issuing a session token or a SAML assertion (a signed XML ticket that tells other apps "this person checked out").
For time-based one-time passwords (TOTP), your authenticator app and the server share a secret key and both run the same algorithm, defined in RFC 6238, to generate a six-digit code that changes every 30 seconds. The codes match only if you hold the right app with the right secret. Hardware security keys go further: they use public-key cryptography and bind their response to the exact website domain, which defeats phishing almost entirely.
Why does MFA matter so much?
Passwords leak constantly. Reused passwords, phishing, and credential-stuffing attacks (automated scripts that try stolen username-password pairs across many sites) mean a password you set years ago may already be circulating in breach databases. MFA means those leaked credentials are useless on their own.
CISA's guidance on MFA notes it is one of the most effective controls an organization can deploy. Microsoft's own telemetry, cited in their identity security documentation, indicates MFA blocks more than 99 percent of automated account-compromise attacks.
Are all MFA methods equally strong?
No, and the differences are meaningful. SMS one-time codes are better than nothing but are vulnerable to SIM-swapping (where an attacker convinces your carrier to move your number to their SIM card) and real-time phishing proxies that forward codes before they expire.
| Method | Phishing resistant | SIM-swap risk | Works offline |
|---|---|---|---|
| SMS code | No | Yes | No |
| Authenticator app (TOTP) | No | No | Yes |
| Push notification | No | No | No |
| FIDO2 hardware key | Yes | No | Yes |
| Passkey (device-bound) | Yes | No | Yes |
NIST SP 800-63B Section 5.2.3 explicitly restricts SMS as a verifier for high-assurance systems. For most people, an authenticator app is a strong and practical upgrade. For high-value accounts, a FIDO2 hardware key is the gold standard.
Does MFA affect authorization as well as authentication?
MFA handles authentication (confirming who you are). Authorization (deciding what you are allowed to do) is a separate step. That said, modern identity systems use the strength of your authentication as an input to authorization decisions. In OpenID Connect (OIDC, a login protocol built on OAuth 2.0), the acr claim inside an ID token signals how strongly the user was verified, and an application can demand a higher acr value before granting access to sensitive data. MFA gets you authenticated; the acr value then influences what you can reach.
Would MFA have stopped a specific breach?
Often, yes. The 2020 Twitter account takeover involved social engineering of internal staff, where even MFA could have limited lateral movement if enforced on internal tools. Many breaches catalogued by CISA trace directly to compromised credentials with no second factor present. MFA is not a magic shield: session-hijacking attacks that steal the token issued after a successful MFA login can still succeed. But MFA removes the easiest and most common path attackers take.
Common questions
Is MFA the same as two-factor authentication (2FA)?
2FA is a subset of MFA that uses exactly two factors. MFA is the broader term covering two or more factors. In everyday use the terms are often swapped, but 2FA is technically more specific.
Can MFA be bypassed by phishing?
Yes, unless the second factor is phishing-resistant. TOTP codes and SMS codes can be captured in real time by a proxy phishing page. FIDO2 keys and passkeys cannot, because they cryptographically bind the response to the legitimate site's origin.
Should I use MFA on every account?
Prioritize email, banking, and any account tied to your identity or payment details first. Those accounts are the keys attackers use to reset everything else. Once those are covered, enable MFA wherever the option exists.
