What multifactor authentication (MFA) is

Multifactor authentication (MFA) is a login and access control method that requires two or more independent factors to verify that someone is authorized. In practice, MFA combines something you know (like a password) with something you have (like a phone app, a hardware key, or a one-time code device) and, sometimes, something you are (like biometric verification on your device).

The protection comes from requiring multiple proofs. If one factor is compromised—most commonly a password—an attacker still has to overcome the additional factor(s) to sign in.

How MFA protects accounts and information

MFA protects in several concrete ways:

It reduces account takeover from password theft

Many breaches expose passwords through phishing, reused credentials, or data leaks. When MFA is enabled, an exposed password alone typically isn’t sufficient to access the account, because the attacker also needs the second factor.

It strengthens identity checks at the moment of login

Even if an attacker guesses, steals, or reuses credentials, MFA requires a separate verification step. This changes the attacker’s path: they must obtain or relay the second factor in time.

It limits the usefulness of “single-step” compromises

Without MFA, a successful login may immediately grant full access. With MFA, attackers often face friction such as needing an authenticator code, completing a second-factor challenge, or possessing a dedicated security key.

It can support better access hygiene

MFA is often paired with safer behaviors and settings, such as requiring re-authentication for sensitive changes (password resets, email changes, or new recovery methods). The exact behavior depends on the service, but the general idea is to reduce the blast radius of one compromised step.

How MFA works in practice

Most MFA flows follow a similar pattern:

  1. You enter your primary credential (often a password).
  2. The service then prompts for a second factor.
  3. The second factor is validated (for example, a time-based one-time code, a push approval on a trusted device, or a cryptographic challenge-response from a hardware key).

If validation succeeds, the session continues. If it fails, the login is denied and the attacker typically cannot proceed.

Important nuance: MFA is only as strong as the factor(s) you choose and the surrounding configuration, especially account recovery.

Differences and limitations you should understand

MFA is helpful, but it has limitations. Two key areas matter most: the type of second factor and the attack path.

Not all factors are equally resistant

Second-factor options differ in how they handle real-world attacks. In general terms:

  • Authenticator apps that generate one-time codes can be more resilient than factors that rely on message delivery alone.
  • Hardware security keys are designed to resist certain forms of relay and phishing more strongly than “enter this code” approaches.
  • SMS-based codes can be vulnerable to certain interception or redirection scenarios.

Because threat models and implementations vary, it’s wise to treat MFA as “stronger,” not “invincible.”

Phishing and real-time relay can still bypass MFA

Some attacker techniques involve tricking a user into starting a login and capturing or relaying authentication prompts in real time. MFA can slow this down, but if the second factor is delivered through a channel an attacker can actively use during the session, the defense may be reduced.

Account recovery can undermine MFA

Even with MFA enabled, attackers may try to regain access via recovery mechanisms. For example, if recovery options (like email or phone controls) are weaker than the login factors, the attacker may reset credentials and set new MFA settings.

“MFA enabled” might not cover everything

Some services treat MFA as a login requirement only, while sensitive actions may require additional re-verification—or may rely on the same MFA session. Also, some services allow multiple MFA methods, and users may accidentally keep weaker ones enabled.

Practical checks you can do today

You can validate your MFA posture without needing advanced tools.

1) Check what second factors are enabled

Review the account’s security settings and confirm that your second factor is something you can securely control (such as an authenticator app or a hardware key). If you see weaker options enabled, consider whether you can switch to stronger ones.

2) Confirm your trusted devices and prompts

For push-based MFA, verify what device receives approvals and whether confirmations require user interaction. If possible, ensure approvals aren’t happening silently.

3) Review account recovery methods

Look at how you would regain access if you lose your phone or hardware key. Ensure the recovery path doesn’t depend on a weaker control that could be compromised.

4) Harden the sensitive-change workflow

If the service offers options for extra verification when changing email, password, or recovery settings, enable them. This helps prevent attackers from completing takeover after the first successful step.

5) Treat unexpected MFA prompts as suspicious

If you receive an MFA challenge you didn’t initiate, treat it as a warning. Deny the prompt, then review recent account activity and sign-in attempts.

Understanding adjacent terms makes MFA easier to place:

  • Threat model: The likely attacker method (credential stuffing, phishing, takeover through recovery) determines whether MFA helps.
  • Session security: A successful login creates a session; MFA mainly protects the initial authentication step, not every subsequent action.
  • Least privilege and re-authentication: Some systems ask for stronger proof again when performing sensitive operations.

If you want to improve protection, focus on aligning MFA strength with how attackers typically target your account type, and ensure recovery paths don’t provide an easier entry than the login itself.