What Is Multi-Factor Authentication (MFA)?

Quick answer

Multi-factor authentication, also called two-step verification or 2FA, requires two or more kinds of proof before an account lets you in, typically something you know, something you have, or something you are. If a thief steals your password, they still cannot log in without the second factor.

Multi-factor authentication: A layered approach to securing online accounts in which a user must present two or more authenticators of different kinds before access is granted.

The three kinds of factor

The Cybersecurity and Infrastructure Security Agency (CISA) describes MFA as a layered approach to securing your online accounts and the data they contain. The layers come from different categories, so that one stolen item is not enough.

The three factor categories
Factor	Examples	What can go wrong
Something you know	A password or PIN	Can be guessed, reused, phished or leaked in a breach
Something you have	A phone with an authenticator app, a security key, a text-message code	Can be lost, stolen, or in some cases intercepted
Something you are	A fingerprint or face scan	Cannot be changed if copied, and quality varies by device

Two passwords do not count as multi-factor, because both come from the same category. A password plus a code from your phone does.

Why a second factor helps

CISA explains the benefit directly: if an attacker compromises one factor, such as your password, they will be unable to meet the second authentication requirement. Passwords are routinely exposed through phishing pages and breaches at other companies, so a login that depends on a password alone fails the moment that password leaks. The agency states that people who enable MFA are significantly less likely to be hacked, without publishing a specific figure.

Not all second factors are equal

CISA states that phishing-resistant MFA is the standard industry should aim for, though any MFA is better than none. The difference matters because a fake login page can trick a person into typing both a password and a one-time code, and the attacker can reuse them immediately.

Common second factors compared
Method	Strength against fake login pages	Everyday convenience
Security key or passkey (FIDO/WebAuthn)	Strongest: the login is bound to the real site	Quick, may need a key or device
Authenticator app with number matching	Better than plain codes or approvals	Quick once set up
One-time code typed from an app	Stops password-only attacks but can be phished	Quick once set up
Code sent by text message	Weakest of the common methods	Works on any phone, no app needed

CISA identifies FIDO/WebAuthn as the widely available phishing-resistant option and recommends number matching where phishing-resistant MFA is not yet possible. NIST's digital identity guidelines (SP 800-63B) classify authenticators by strength and treat delivering codes over the telephone network as a restricted type that carries additional risk, which is why text-message codes sit at the bottom of many rankings while still being far better than nothing.

How to turn it on sensibly

Start with the accounts that would hurt most if taken over: your main email, because it can reset other passwords, then banking, cloud storage and social accounts. In each account's security settings look for names like two-step verification or 2FA. Prefer a security key or passkey where offered, an authenticator app next, and a text message only if nothing better is available. Save any backup codes the service provides in a safe place, because losing the only device that holds your second factor can lock you out.

Never share a code

A legitimate service will not phone or message you asking you to read out a verification code. If someone asks for one, treat it as an attempt to take over your account.

What MFA does not fix

MFA reduces the damage from stolen passwords but does not cure every attack. A person tricked into approving a login prompt, or into installing malicious software on their device, can still lose an account. It works best together with unique passwords, a password manager, updated devices and careful reading of the address of every page that asks for credentials, as discussed in What Is HTTPS.