Cybersecurity glossary
What is Multi-Factor Authentication (MFA)?
Learn what multi-factor authentication (MFA) is, how knowledge possession and inherence factors combine, why phishing-resistant MFA matters, and how to deploy MFA without weak fallbacks.
Definition
Multi-Factor Authentication (MFA) is an authentication method that requires two or more independent factors—typically something you know, have, or are—before granting access, so stolen passwords alone are usually insufficient for account takeover.
Why MFA matters
Passwords leak constantly through phishing, stuffing, and malware. Multi-Factor Authentication (MFA) adds another proof of identity so a password alone rarely completes login. It is one of the highest-ROI controls for account takeover prevention.
Not all MFA is equal. SMS codes and push prompts help, but phishing-resistant authenticators close entire attack classes that still defeat weaker second factors.
How MFA works
User presents a first factor
Typically a password, PIN, or another primary authenticator.
System requests an additional factor
A possession or inherence challenge is required based on policy.
User completes the challenge
Approves a push, enters an OTP, touches a security key, or uses biometrics to unlock a passkey.
Verifier validates both
Access is granted only when required factors succeed within policy constraints.
Session is established
A browser or app session continues under normal session-security controls.
Risk engine may step up again
Sensitive actions can demand fresh MFA even inside an existing session.
Factor types and common methods
| Factor | Examples | Notes |
|---|---|---|
| Knowledge | Password, PIN | Phishable; necessary but insufficient alone |
| Possession | OTP app, SMS, push, security key | Strength varies widely by method |
| Inherence | Fingerprint, face | Often unlocks a device-bound key rather than standing alone remotely |
Phishing-resistant (preferred)
FIDO2/WebAuthn security keys and passkeys bound to origin.
OTP applications
Time-based codes in authenticator apps; better than SMS, still phishable in real time.
Push notifications
Convenient but vulnerable to MFA fatigue unless number matching and rate limits exist.
SMS / voice
Better than nothing for consumers; weak for high-risk and admin accounts.
MFA bypass patterns to design against
Attackers do not always “break cryptography.” They bypass process: fatigue users with repeated pushes, proxy phishing pages that harvest OTPs live, steal cookies after successful MFA, or abuse help-desk recovery that skips the second factor.
Deployment checklist
- Enforce MFA for administrators, remote access, email, and financial systems first.
- Prefer phishing-resistant authenticators for privileged and high-risk users.
- Disable or strictly control weaker methods when stronger ones are enrolled.
- Harden recovery: do not let SMS or email resets silently remove MFA.
- Use number matching and attempt limits for push MFA to reduce fatigue attacks.
- Protect sessions after MFA with secure cookies, short lifetimes, and anomaly detection.
- Cover every client: web, mobile, VPN, and legacy protocols that might skip MFA.
- Monitor MFA failures, enrollment changes, and impossible-travel logins.
The practical takeaway
MFA requires multiple independent authentication factors so stolen passwords rarely equal account takeover. It is foundational identity security—especially when phishing-resistant methods are used.
Deploy MFA broadly, upgrade privileged users to passkeys or security keys, and treat weak recovery and session theft as part of the MFA threat model—not footnotes.
Related security terms
Biometric Authentication
An inherence factor often used to unlock phishing-resistant authenticators.
Broken Authentication
Failures in login and recovery that MFA is meant to reduce—but weak MFA can still fail.
Credential Stuffing
Password-reuse attacks that MFA substantially mitigates when enforced.
Single Sign-On (SSO)
Centralized login where MFA at the identity provider protects many applications.
OAuth 2.0
Delegated authorization flows that should still enforce strong user authentication.
Frequently asked questions
What is MFA in simple terms?
MFA means proving your identity with more than one kind of evidence—like a password plus a phone approval or security key—so a stolen password alone usually cannot open the account.
Is 2FA the same as MFA?
Two-factor authentication is MFA with exactly two factors. MFA is the broader term for two or more factors.
What are the three classic factor types?
Knowledge (password/PIN), possession (phone, hardware key, app), and inherence (biometrics). Effective MFA uses independent factors from different categories.
What is phishing-resistant MFA?
Methods such as FIDO2/WebAuthn security keys and passkeys that cryptographically bind authentication to the real site, making fake-login phishing far less effective than SMS or basic OTP prompts.
Why is SMS MFA considered weaker?
SMS codes can be intercepted via SIM swap, SS7 abuse, or malware, and users can be phished into revealing codes. It is still better than passwords alone but not ideal for high-risk accounts.
Can attackers bypass MFA?
Yes, through MFA fatigue push spam, phishing kits that proxy OTP entry, session theft after MFA, weak recovery flows, or social engineering of help desks.
Should every account use MFA?
Prioritize administrators, remote access, email, and finance first, then expand broadly. Privileged users should use phishing-resistant methods whenever possible.
References
Explore authoritative guidance and frameworks related to multi-factor authentication (mfa).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.