MFA (multi-factor authentication)

Multi-factor authentication (MFA) is a sign-in method that requires at least two independent pieces of evidence for your identity, so a stolen password on its own is no longer enough. In everyday use the term is treated as interchangeable with two-factor authentication (2FA), which is simply the case of exactly two factors.

What it means

Factors fall into three categories. Knowledge is something you know, such as a password or a PIN. Possession is something you have, such as a phone, a smartcard or a hardware security key. Inherence is something you are, such as a fingerprint or a face scan. Genuine MFA combines categories: a password plus a security question is knowledge twice over and adds no second layer. Location, time of day and device posture are signals for a risk decision, but they are not factors.

Why it matters

Password-only attacks such as credential stuffing after a breach elsewhere or brute force against a login page run into a wall at a correctly configured second factor. What MFA does not do is make every implementation equivalent.

One-time codes by SMS are the weakest common option: the phone number is not the phone. It can be moved to an attacker through a SIM swap at the operator, intercepted in the mobile network, or inherited by someone else when a disused number is recycled. Push approvals fail in a different way. An attacker who already holds the password triggers prompt after prompt until the user taps approve to make it stop, a pattern known as MFA fatigue. Every code-based or push-based factor, authenticator apps included, can also be relayed in real time: a phishing kit acting as a reverse proxy passes your input to the real site and keeps the session cookie.

FIDO2 and WebAuthn, the standards behind passkeys and hardware keys, close that gap by design. The private key never leaves the device, and the signature it produces covers the origin that asked for it. The browser will only offer a credential registered for that exact origin, so a lookalike domain gets nothing it can replay. There is also no shared secret on the server to steal.

Example

An administrator account is protected with a password and push approvals. The password surfaces in a credential dump, and late one evening the attacker sends approval request after approval request until one is accepted. No malware, no exploit. With a passkey the same attempt would have failed at the first step.