Definition and the core idea

Multifactor authentication (MFA) is a login method that asks for two or more independent ways to verify that you are who you claim to be. Instead of relying only on a password (one factor), MFA combines a password with an additional factor such as a code, a hardware key, or a biometric signal.

The key security benefit is reduction of reliance on any single piece of evidence. If one factor is stolen or guessed, the attacker typically still cannot pass the other required checks.

A simple way to understand factors

MFA can be described using common “factor” categories:

  • Knowledge: something you know (for example, a password or PIN).
  • Possession: something you have (for example, a phone that receives a one-time code, or a hardware security key).
  • Inherence: something you are (for example, a fingerprint or facial recognition).

In practice, many sign-in flows use one factor from knowledge plus one factor from possession or inherence. The exact options vary by service, but the general pattern is the same: multiple, independent proofs.

How MFA works in a sign-in flow

A typical MFA sign-in process goes like this:

  1. You enter your username and password (or another primary credential).
  2. If the first step is accepted, the system prompts for an additional factor.
  3. You provide the second factor (for example, a one-time code, push approval, or hardware key touch).
  4. If both factors satisfy the policy, access is granted.

Some services also offer different MFA “strengths” or step-up behavior (for example, requiring MFA more often for sensitive actions or new devices). What matters conceptually is that access depends on more than one verification step.

Differences, limits, and exceptions

MFA is not a magic shield, and it can still be bypassed in certain scenarios.

  • Phishing and social engineering: If an attacker tricks you into approving a login or entering a code, the second factor can be used against you even though MFA is enabled.
  • Device and account recovery: MFA does not help much if recovery options can be abused (for example, weak recovery controls or unclear handling of lost devices).
  • Availability and user impact: If you lose access to your phone or security key, you may be unable to sign in until you use a backup method or account recovery.

A helpful rule of thumb: MFA lowers the chance that password-only compromise leads to account takeover, but you still need to protect the second factor and stay cautious about suspicious sign-in prompts.

What you can check to verify MFA coverage

To confirm that MFA meaningfully protects your accounts, you can:

  • Look for whether your account uses more than one factor for normal sign-in.
  • Check which factor types are supported (for example, one-time codes versus hardware keys).
  • Review what happens when a factor is unavailable (backup codes or alternate sign-in methods, if provided).
  • Be alert to MFA prompts you did not request, and avoid approving codes or pushes after unexpected login notifications.