What is multi-factor authentication (MFA)?
Multi-factor authentication (MFA) requires two or more independent kinds of proof to sign in: something you know (a password), something you have (a phone or security key) and something you are (a fingerprint or face).
How it works
Common factors include one-time codes by text or app, push notifications, hardware security keys and passkeys. They differ in how well they resist phishing: codes and push prompts can be stolen or approved under pressure; passkeys and FIDO2 keys cannot be relayed.
MFA hygiene matters too: who has not enrolled, who uses the weakest factor, and who approves prompts they did not start.
Why it matters
MFA stops most attacks that rely on a stolen password alone. Attackers have adapted with MFA fatigue, SIM swapping and adversary-in-the-middle phishing, so the factor chosen matters.
