Skip to content
Knowledge Hub/Article
Article

What Is MFA? Two-Factor and Multi-Factor Authentication

A second factor protects an account even after its password is stolen. We cover factor types, SMS, app codes and passkeys, MFA bypass and where to start.

Oğuzhan Gerçek··9 min read
What Is MFA? Two-Factor and Multi-Factor Authentication

Short answer: Multi-factor authentication (MFA) verifies a person's identity at sign-in with at least two different types of evidence: something you know (a password or PIN), something you have (a phone or security key) or something you are (a fingerprint). 2FA is MFA with two factors. An attacker who steals the password still has to get past the second factor to get into the account. The methods are not equally strong: an SMS code is the weakest option, while passkeys and security keys based on FIDO2/WebAuthn resist phishing.

What is MFA?

In the definition from NIST SP 800-63-4, MFA is an authentication system that requires more than one distinct type of authentication factor for successful authentication; the factors can come from a single authenticator or from separate ones. Biometrics alone are not enough. According to NIST's SP 800-63B-4, published in July 2025, biometric characteristics are not secrets: a facial image can be obtained by taking a picture. The guideline therefore accepts biometrics only together with a physical authenticator, something you have.

We cover authorization, which decides what a verified user can access, in our IAM article.

2FA vs. MFA vs. two-step verification

NIST's MFA explainer treats two-factor authentication (2FA) as another name for MFA. According to the same page, the credentials must come from two different categories; entering two different passwords would not be considered multi-factor. Google likewise uses 2-Step Verification and two-factor authentication as equivalent names. So what matters is the type of factor, not the number of steps. A security question asked after the password is a second step, but the sign-in remains single-factor.

SMS, authenticator apps and push notifications

  • SMS and voice calls: SP 800-63B-4 names the use of the public switched telephone network (PSTN) to deliver codes as the only restricted authenticator at the time of publication; an organization that relies on it must also offer an unrestricted alternative. The US cybersecurity agency CISA sees SMS as a last resort, because it is vulnerable to phishing, exploitation of SS7 weaknesses and SIM swapping.
  • Authenticator apps: HOTP (RFC 4226) generates a code of at least six digits from a counter and a secret key. TOTP (RFC 6238) replaces the counter with time; the RFC recommends a default time step of 30 seconds. The code is unaffected by SIM swapping, but because it is typed in by hand, it can just as easily be typed into a fake sign-in page.
  • Push notifications: According to CISA, an attacker who has the password can bombard the user with prompts until the user approves one by accident or out of annoyance; this is known as MFA fatigue (push bombing). With number matching, the user cannot approve a request without typing the number shown on the sign-in screen into the app. CISA treats this as the interim measure to use until phishing-resistant MFA is in place.

Phishing-resistant MFA: FIDO2, passkeys and smart cards

SP 800-63B-4 defines phishing resistance as the ability of the authentication protocol to prevent the disclosure of authentication secrets and valid authenticator outputs to an impostor verifier. Outputs entered by hand, such as codes, do not qualify, because they are not bound to the session being authenticated. The guideline requires at least one phishing-resistant option to be offered at assurance level AAL2 and makes phishing resistance mandatory at AAL3.

According to CISA, the only widely available phishing-resistant authentication is FIDO/WebAuthn; a less widely available route is smart cards tied to an organization's PKI. FIDO2 consists of the WebAuthn and CTAP standards, and WebAuthn Level 3 became a W3C Recommendation on August 25, 2026. As the FIDO Alliance's Passkey Central explains, the private key stays on the device and only the public key is registered with the service; at sign-in, the challenge sent by the server is signed with the private key. A passkey is only presented to the site it was registered with, so it cannot be typed into an attacker's site. According to the FIDO Alliance, passkeys can be synced across devices or bound to a single device. SP 800-63B-4, however, does not allow syncable authenticators at AAL3, because their private keys are exportable.

How MFA gets bypassed

  • SIM swapping: The attacker tricks the mobile carrier, or pays off one of its employees, into moving the victim's number to a SIM card the attacker controls. According to an FBI IC3 announcement, IC3 received 1,611 SIM swapping complaints in 2021, with adjusted losses of more than $68 million.
  • AiTM phishing: The attacker places a proxy between the user and the real site and steals the session cookie along with the password; according to Microsoft, this skips authentication even when MFA is enabled. The fix Microsoft recommends is FIDO2 and certificate-based authentication. We cover the campaign and how to spot such attacks in our phishing article.
  • Session cookie theft: According to MITRE ATT&CK, cookies often stay valid for a long time, and a stolen cookie can bypass some MFA protocols. MITRE recommends shortening cookie lifetimes and allowing sign-ins only from trusted devices.
  • Help desk: According to CISA's Scattered Spider advisory, the group convinces IT help desk staff to reset passwords and MFA tokens. We cover this technique in our social engineering article.

For detecting these attempts, see our security operations page.

How effective is MFA?

A study published by Microsoft researchers in May 2023 looked at Azure AD (now Microsoft Entra ID) accounts that were reviewed for suspicious activity between April 22 and September 22, 2022. MFA reduced the risk of compromise by 99.22% across the whole population and by 98.56% for accounts with leaked passwords. In the leaked-password sample, SMS was 40.8% less effective than Microsoft's authenticator app; no FIDO-based method was part of the comparison. The authors also note that measurements based on reported compromises will undercount the real figure.

Where to start

CIS Controls v8.1 requires MFA in its first implementation group (IG1), which it defines as essential cyber hygiene, for externally exposed applications (6.3), remote network access (6.4) and administrative access (6.5). CISA points out that attackers often target email systems, file servers and remote access systems. NIST SP 800-207, which describes zero trust architecture, also expects MFA for access to some or all enterprise resources.

  • Email: According to Microsoft, legacy authentication protocols don't support MFA; the details are in our business email article.
  • VPN: We explain why VPN gateways are targets in our VPN article.
  • Admin accounts: A joint NSA and CISA advisory recommends mandating MFA, ideally phishing-resistant, for privileged users and making it a default rather than an opt-in feature. We cover privileged access management (PAM) and directory services such as Active Directory in our IAM article.
  • Cloud consoles: Since October 2024, Microsoft has required MFA for the Azure portal and its admin centers. AWS extended its MFA requirement for root users to all account types in June 2025.

Recovery codes and backup methods

SP 800-63B-4 recommends encouraging users to maintain at least two separate means of authentication. The NSA and CISA IAM guide is blunt about the risk: if a user can enroll a new authenticator with a password alone, the security of MFA is severely undermined. Its recommendation is to issue each user several strong authenticators and keep one in reserve in a secure location. A recovery code, in NIST's definition, is a secret that lets users recover an account they can no longer authenticate to; Google's codes are eight digits long and single-use. We handle the authentication layer in our identity management service.

Frequently asked questions

What is 2FA (two-factor authentication)? It means requiring two different types of evidence at sign-in, for example a password plus a code from an authenticator app. It is MFA with two factors.

What is the difference between MFA and 2FA? 2FA uses exactly two factors, while MFA covers two or more. Every 2FA setup is also MFA.

Is two-step verification the same as two-factor authentication? In practice the terms are often used interchangeably; Google uses both for the same feature. What counts is the type of factor: if both steps are something you know, the sign-in is not multi-factor.

Is SMS authentication secure? It is the weakest method, open to SIM swapping, SS7 exploitation and phishing. CISA treats it as a last resort.

What is a passkey? A FIDO credential that replaces the password and works with a private key kept on a device or in a password manager. Because it is only presented to the site it was registered with, it resists phishing.

Does MFA fully protect an account? No. It cuts the risk sharply, but it can be bypassed through AiTM phishing, stolen session cookies or a deceived help desk.

Sources