Overview
Multi-factor authentication (MFA) requires more than just a password, dramatically reducing the risk of account takeover even when a password is stolen. This lesson explains MFA and why it is one of the highest-value authentication controls.
Learning objectives
- Define MFA and the categories of authentication factors.
- Explain why MFA resists common credential attacks.
- Recognize the relative strength of MFA methods.
Core concept
MFA requires two or more factors from different categories:
- Something you know — a password or PIN.
- Something you have — a phone, hardware token, or authenticator app.
- Something you are — a biometric (fingerprint, face).
Requiring factors from different categories means stealing one (e.g. a password) is not enough. Common second factors include authenticator-app TOTP codes, push approvals, and hardware security keys (FIDO2/WebAuthn), the last being the strongest against phishing.
How it works
After a correct password, the app requires a second factor — for example, a time-based code from an authenticator app or a tap on a hardware key. Because the second factor is not known to an attacker who only stole the password, credential theft, phishing, and stuffing are largely neutralized. Not all methods are equal: SMS codes are better than nothing but vulnerable to interception/SIM-swapping; authenticator apps are stronger; hardware security keys resist even real-time phishing because they cryptographically bind to the site.
Practical example
An attacker obtains Alice's password from a breach and tries to log in. With MFA enabled, the login also demands a code from Alice's authenticator app (or a tap on her security key), which the attacker does not have — so the login fails despite the correct password. Had Alice used a phishing-resistant hardware key, even a convincing fake login page could not relay the factor. MFA converted a stolen password from "account takeover" into "failed attempt."
Cybersecurity relevance
MFA is among the most effective defenses against credential-based attacks, which are extremely common. It protects accounts even when passwords are weak, reused, or breached. Security programs strongly recommend (or require) MFA, especially for privileged and remote access. Assessments note the absence of MFA on sensitive accounts; when evaluating MFA, method strength matters (prefer app-based or hardware keys over SMS). MFA complements — but does not replace — good password storage and login hardening.
Common mistakes
- Relying on SMS as the only second factor, which is susceptible to interception/SIM-swapping.
- Treating MFA as a replacement for secure password storage and rate limiting rather than a complement.
- Not enforcing MFA on privileged/remote access, the highest-value accounts.
Key takeaways
- MFA requires factors from different categories — know (password), have (device/key), are (biometric) — so one stolen factor is insufficient.
- It strongly resists credential theft, phishing, and stuffing; hardware security keys (FIDO2/WebAuthn) are the most phishing-resistant, SMS the weakest common method.
- MFA is one of the highest-value authentication controls, especially for privileged access, and complements (not replaces) other login defenses.
Check your understanding
- Why does requiring factors from different categories make MFA effective against stolen passwords?
- Why are hardware security keys considered stronger than SMS-based codes?