What Is Multi-Factor Authentication? MFA, 2FA, and Passwordless Explained

What Is Multi-Factor Authentication?

Multi-Factor Authentication (MFA) requires users to present two or more distinct forms of evidence — factors — to prove their identity before gaining access. The three categories of factors are:

• Something you know: Password, PIN, security question
• Something you have: Phone, hardware token, smart card
• Something you are: Fingerprint, face scan, iris scan (biometrics)

When two factors are required, it is called Two-Factor Authentication (2FA). When it is specifically a password plus a second factor, this is most common — though technically "2FA" is a subset of MFA.

Why MFA Matters

A stolen password alone is not sufficient to access an MFA-protected account. Even if an attacker obtains your password through phishing, a data breach, or credential stuffing, they still need the second factor — which they typically do not have.

credential stuffing — trying stolen username/password combinations from data breaches at scale — is responsible for billions of unauthorised logins annually. MFA stops credential stuffing cold.

Microsoft reports that MFA blocks 99.9% of automated account attacks.

Types of Second Factors

SMS One-Time Passwords (OTP)

A six-digit code texted to your phone, valid for a few minutes.

Why SMS 2FA is weak:

• SIM swapping: Attackers social-engineer the mobile carrier into transferring your number to their SIM, intercepting all your texts
• SS7 attacks: Vulnerabilities in the telephony infrastructure allow interception of SMS
• phishing: Real-time phishing attacks relay the OTP before it expires
• malware: Phone malware can read SMS messages

SMS 2FA is much better than no MFA, but organisations with high security requirements should use stronger methods.

TOTP: Time-Based One-Time Passwords

An authenticator app (Google Authenticator, Microsoft Authenticator, Authy) generates a six-digit code that changes every 30 seconds based on a shared secret and the current time.

• Standard: RFC 6238 (TOTP)
• Not vulnerable to SIM swapping
• Works offline
• Still vulnerable to real-time phishing (attacker relays the code in the same 30-second window)

Hardware Tokens

Physical devices that generate OTPs (RSA SecurID) or use cryptographic challenges (FIDO hardware tokens). Used in high-security enterprise environments.

FIDO2 / WebAuthn / Passkeys

FIDO2 (Fast IDentity Online 2) is the strongest MFA standard available. It uses [public key cryptography-symmetric-vs-asymmetric)](/learning-center/what-is-encryption-symmetric-vs-asymmetric) bound to a specific website domain-kerberos-directory-services-explained):

1. The authenticator (phone, YubiKey, or built-in platform authenticator) generates a key pair per site
2. The private key-symmetric-vs-asymmetric) never leaves the device
3. Login proves possession of the private key-symmetric-vs-asymmetric) via a cryptographic challenge-response
4. The response is cryptographically bound to the domain-kerberos-directory-services-explained) — a phishing site cannot reuse it

passkeys (Apple, Google, and Microsoft) implement FIDO2 with a synced credential backed by the platform (iCloud Keychain, Google password manager). They replace the password entirely — no password to steal.

YubiKey is a hardware FIDO2 token: a small USB/NFC device that stores private keys in secure hardware. Even if your phone is compromised, the YubiKey cannot be cloned.

Phishing Resistance

| MFA Type | phishing-Resistant? | SIM Swap Resistant? | |---|---|---| | SMS OTP | ❌ | ❌ | | TOTP authenticator app | ❌ | ✅ | | Push notification | ❌ (MFA fatigue) | ✅ | | FIDO2 / passkey | ✅ | ✅ | | Hardware token (FIDO2) | ✅ | ✅ |

FIDO2 is the only commonly available MFA that is phishing-resistant — the cryptographic response is domain-kerberos-directory-services-explained)-bound, so a phishing site cannot capture and reuse it.

MFA Fatigue Attacks

Push notification MFA (e.g., "Approve or deny login?") is convenient but vulnerable to MFA fatigue (also called MFA bombing): the attacker sends repeated push notifications, hoping the victim will eventually approve to make them stop. This technique was used in the 2022 Uber breach.

Defences: Use number matching (the app shows a number the user must match from the login screen), require biometric approval, or limit notification frequency.

Passwordless Authentication

Passwordless authentication eliminates passwords entirely, replacing them with a stronger factor:

• passkeys: Synced FIDO2 credentials — use your fingerprint or face on your phone
• Magic links: One-click login links emailed to you
• Hardware tokens: Always-on FIDO2 without passwords

passkeys are rapidly being adopted by Apple, Google, Microsoft, and major services. They provide phishing resistance and eliminate the entire class of password-based attacks.

Implementing MFA: Practical Guidance

For individuals:

• Enable TOTP authenticator app MFA on all important accounts (email, banking, work)
• Avoid SMS 2FA where an authenticator app is available
• Register passkeys on sites that support them (GitHub, Apple ID, Google, Microsoft)

For organisations:

• Mandate MFA for all employees; prioritise phishing-resistant methods for privileged access
• Use Conditional Access policies — require stronger MFA for sensitive resources or unusual sign-in locations
• Configure MFA fatigue protection: number matching, rate limiting-attack-distributed-denial-of-service-explained) push notifications
• Privileged admin accounts should use hardware FIDO2 tokens (YubiKey or similar)

Recovery Codes

When setting up MFA, services provide recovery codes — one-use codes used to regain access if you lose your second factor. Store these offline and securely (printed and in a safe, or in a password manager). Losing both your second factor and recovery codes can permanently lock you out.

Summary

• MFA requires a second proof of identity in addition to a password, dramatically reducing account takeover risk
• The three factor categories: something you know, something you have, something you are
• SMS 2FA is better than nothing but vulnerable to SIM swapping and real-time phishing
• TOTP authenticator apps are stronger; FIDO2/passkeys are phishing-resistant
• MFA fatigue attacks flood push notifications hoping the user approves; use number matching to defend
• passkeys eliminate passwords entirely and are the recommended direction for modern authentication