Multi-factor authentication (MFA)
Also known as: MFA, 2FA, two-step verification, multifactor authentication, strong authentication
Multi-factor authentication (MFA) adds a second step to logging in (typically a code from an app, a tap on your phone, or a hardware key) on top of your password.
Even if an attacker steals or guesses your password, they can't get in without that second factor, which stops the vast majority of account takeovers.
Multi-factor authentication (MFA), explained at three levels
At home
A house key alone opens most front doors, but a bank safety deposit box needs your key and the bank's key together. MFA brings that idea to logins. After your password, the site asks for a second proof, such as a code from an app, a tap on your phone, or a fingerprint. A thief who steals your password still lacks the second piece, so the door stays shut.
At work
Multi-factor authentication requires two or more separate proofs of identity before granting access, usually a password plus a phone or hardware key. For a business, it is the most effective single defence against account takeover, because most breaches start with stolen or guessed passwords. Microsoft has reported that MFA blocks more than 99% of automated account attacks, which is why insurers now demand it.
At home
Factors come in three types: something you know, like a password or PIN; something you have, like your phone or a security key; and something you are, like a fingerprint or face. MFA needs two different types, so two passwords don't count. The common 'have' methods differ in strength. SMS codes can be stolen through SIM swapping, authenticator apps generate a fresh code every 30 seconds, and passkeys use cryptography.
At work
In a business, MFA is enforced by the identity provider, such as Microsoft Entra ID or Google Workspace, so one policy covers email, files, and connected apps. Methods include SMS, authenticator app codes (TOTP), push approvals with number matching, and FIDO2 security keys or passkeys. Push approvals are vulnerable to 'MFA fatigue', where attackers spam prompts until someone taps approve, which is why Microsoft Authenticator now makes users type a displayed number.
At home
App codes rely on a shared secret: your phone and the server both hold it and combine it with the current time to produce the same six digits. Anyone who tricks you into typing that code into a fake site can replay it. Passkeys work differently, signing a challenge with a private key that only answers the real website's domain. In my opinion, passkeys are the first MFA method that ordinary people can't be phished out of.
At work
Enterprise MFA sits inside conditional access, where policies weigh user risk, device compliance, and location before deciding to allow, prompt, or block. Legacy protocols such as POP, IMAP, and SMTP with basic authentication bypass MFA entirely and must be disabled. NIST SP 800-63B classes FIDO2 authenticators and passkeys as phishing-resistant, and CISA urges them for administrators. Plan break-glass admin accounts and backup factors, because a lost phone shouldn't lock an owner out of the tenant.
Real-world examples
At home
Sophie's email password turned up in a data breach and someone tried to log in from overseas. Because she had an authenticator app enabled, the attacker hit the second-factor prompt and was stopped cold. Sophie just changed her password and moved on.
At work
Marcus's real estate brokerage rolled out MFA on Microsoft 365 for all agents. Within a month, a phishing campaign harvested two agents' passwords, but neither account was breached, because the attackers couldn't pass the authenticator prompt.
How it compares
| feature | SMS code | Authenticator app | Passkey / FIDO2 key |
|---|---|---|---|
| Security level | Basic | Good | Strongest |
| Phishing resistant | No | No (codes can be relayed) | Yes |
| Works offline | No (needs signal) | Yes | Yes |
| Cost | Low | Free | Hardware cost |
| Best for | Better than nothing | Most staff | Admins, high-risk accounts |
For analysts
MFA is the highest return-on-investment security control for a small business. Prioritize enabling it everywhere it's offered (starting with email, banking, and any account with administrative rights) and prefer app-based or passkey methods over SMS.
History & origin
The idea of combining 'something you know' with 'something you have' dates back decades to hardware tokens used in banking and government. Consumer MFA spread in the 2010s as breaches exposed billions of passwords and reuse made single-factor logins dangerous. App-based authenticators and push notifications replaced clumsy SMS codes, and by the 2020s phishing-resistant methods (passkeys, FIDO2 keys) emerged to counter attackers who could relay one-time codes in real time.