MFA, or multi-factor authentication, is an authentication method that requires two or more independent factors from different categories before a user is granted access: something the user knows, something the user has and something the user is. In cybersecurity, and specifically in identity and access management, MFA exists because a single stolen password should not be enough to take over an account.
The strength of MFA comes from independence between factors. An attacker who phishes a password still needs the physical device or biometric trait, which forces a second, separate compromise. Two-factor authentication, often abbreviated 2FA, is the most common form of MFA and uses exactly two factors.
How MFA verifies identity with independent factors
MFA works by combining factors from different categories, not by stacking several secrets of the same kind. A password plus a security question is still single-factor, because both are knowledge factors that can be stolen in the same phishing attack.
The three classic categories are listed below with typical examples and the main way each is attacked.
| Factor category | Examples | Typical attack |
|---|---|---|
| Knowledge | Password, PIN, passphrase | Phishing, credential stuffing, guessing |
| Possession | Phone app, hardware key, smart card | Device theft, SIM swap, push fatigue |
| Inherence | Fingerprint, face, voice | Spoofing, presentation attacks |
In a typical login, the identity provider first validates the password, then issues a second challenge to the registered device. Modern systems also apply adaptive or risk-based MFA, which raises or lowers the challenge depending on signals such as device reputation, location, time of day and the sensitivity of the requested resource.
MFA methods and their resistance to phishing
MFA methods differ widely in how well they resist real attacks, and choosing the method matters as much as enabling MFA at all. The critical distinction is whether the method is phishing-resistant, meaning a fake login page cannot capture and replay the second factor.
| Method | Phishing resistance | Main weakness |
|---|---|---|
| SMS one-time code | Low | SIM swapping and interception |
| Voice call code | Low | Social engineering and call forwarding |
| TOTP authenticator app | Low to moderate | Codes can be relayed by a proxy |
| Push notification | Moderate | Fatigue attacks with repeated prompts |
| Push with number matching | Moderate to high | Still vulnerable to real-time proxies |
| FIDO2 security key or passkey | High | Recovery process if the key is lost |
| Smart card with certificate | High | Deployment and card management cost |
TOTP codes are generated from a shared secret and the current time, usually as six digits refreshed every 30 seconds under the TOTP standard, RFC 6238. FIDO2 and passkeys are stronger because the browser binds the cryptographic response to the website origin, so a lookalike domain receives nothing it can reuse.
MFA compared with related identity concepts
MFA is one control within authentication, and it is often confused with neighboring concepts that solve different problems. Authentication proves who the user is, while authorization decides what that verified user may do.
| Concept | Question it answers | Relationship to MFA |
|---|---|---|
| Authentication | Who is this user | MFA is a stronger form of it |
| Authorization | What may the user access | Applied after MFA succeeds |
| SSO | Can one login serve many apps | Centralizes where MFA is enforced |
| Passkey | Can a password be replaced | Often satisfies MFA in one step |
| RBAC | Which role grants which rights | Independent of the login method |
A passkey stored on a phone and unlocked with a fingerprint combines possession and inherence in a single gesture, which is why many organizations accept it as MFA. Pairing MFA with single sign-on is efficient because the strong check happens once at the identity provider rather than separately in every application.
Deploying MFA in an organization
A successful MFA rollout prioritizes the accounts with the greatest impact and plans enrollment, recovery and exceptions before enforcement. Administrators, remote access, email and cloud consoles are the usual first targets.
The decision table below matches common situations with a recommended method.
| Situation | Recommended method | Reason |
|---|---|---|
| Privileged administrators | FIDO2 hardware keys | Highest phishing resistance |
| General workforce | Passkeys or number-matching push | Strong security with low friction |
| Shared or kiosk devices | Smart cards or hardware keys | No personal phone required |
| Customers of a consumer app | Passkeys with TOTP fallback | Broad device support |
| Legacy systems without modern protocols | MFA at a gateway or VPN | Protects apps that cannot integrate |
Account recovery is the weakest link in many deployments. If a help desk resets MFA after a convincing phone call, attackers will target the help desk instead of the factor, so recovery must require verification as strong as the original enrollment.
Limitations and common MFA bypass techniques
MFA greatly reduces account takeover, but it does not make an account invulnerable. Attackers have adapted with techniques that target the session, the user or the recovery process rather than the factor itself.
| Technique | How it works | Countermeasure |
|---|---|---|
| Adversary-in-the-middle phishing | Proxy relays login and steals the session cookie | Phishing-resistant FIDO2 methods |
| MFA fatigue | Repeated push prompts until the user approves | Number matching and prompt limits |
| SIM swapping | Attacker moves the phone number to a new SIM | Avoid SMS for sensitive accounts |
| Session token theft | Infostealer copies cookies after login | Short session lifetimes, token binding |
| Help desk social engineering | Caller requests an MFA reset | Strict identity proofing for resets |
A frequent mistake is leaving legacy authentication protocols enabled, such as older mail protocols that accept only a password. These paths silently skip MFA and should be disabled once modern clients are in place.
A non-technical view
MFA works like a bank vault that needs both a key and a code. Knowing the code is not enough, and holding the key is not enough. You need two different kinds of proof at the same time.
For an online account, the first proof is usually a password, and the second is something you carry, such as your phone or a small security key, or something you are, such as your fingerprint. Even if someone steals your password, they still cannot get in without the second piece.
A concrete example
A regional healthcare provider with about 1,500 staff relies on passwords plus SMS codes for its email and remote access. After several employees receive convincing phishing emails that relay both the password and the SMS code through a fake login page, the security team decides to move to phishing-resistant MFA.
The team issues FIDO2 hardware keys to all 40 administrators first, then enables passkeys and number-matching push for the remaining staff. It disables legacy mail protocols, shortens session lifetimes for remote access and requires an in-person or video identity check for MFA resets. In the following months, phishing emails continue to arrive, but no account is taken over through a relayed login, because the fake pages can no longer capture a reusable second factor.