MFA

Multi-factor authentication (MFA) is a method of confirming a user’s identity by requiring two or more independent credentials. By combining factors from at least two categories, MFA reduces the likelihood that a compromised password alone is enough to gain access. The categories typically include something you know (a password or PIN), something you have (a hardware token, a mobile device, or a security key), something you are (biometric identifiers such as fingerprints or facial recognition), and, less commonly, something you do (an action pattern).

Common implementations include authenticator apps generating time-based one-time passwords (TOTP), push-based approvals, and hardware keys using the FIDO2/WebAuthn standard. Many services also support SMS-based one-time passwords as a lower-security option. In professional environments, MFA can be integrated with identity and access management or single sign-on systems to enforce policies across applications.

MFA reduces the risk of account compromise by limiting the usefulness of stolen credentials, and it is recommended by many security guidelines and regulators. However, MFA is not a panacea: phishing can still target some workflows, second factors can be lost or stolen, and adoption adds friction and cost. SMS-based OTPs are particularly vulnerable to interception and SIM swapping, while hardware keys require procurement and user training.

In practice, organizations are increasingly adopting phishing-resistant options such as hardware keys or platform-native authenticators. Standards like WebAuthn and FIDO2 guide interoperable implementations, while considerations of privacy and accessibility influence factor choices. MFA is widely supported by major platforms and services.