MFA : IT definition

Simple definition

MFA improves sign-in security by requiring proof from more than one factor category, such as something you know and something you possess.

Technical definition

Authentication factors include knowledge (password or PIN), possession (security key or trusted device) and inherence (biometric verification). Phishing-resistant methods, including correctly deployed FIDO2 security keys and passkeys, generally provide stronger protection than SMS one-time codes.

User Requests sign-in
First factor For example, a password
Second factor Key, device or biometrics
Identity provider Validates the factors
Access decision According to policy

Two passwords are not two distinct factors. Phishing-resistant FIDO2 passkeys can also enable passwordless authentication.

What is it used for ?

Protect administrator accounts, cloud services, VPN access and remote applications, particularly when credentials may be exposed.

Practical example

A user enters a password and confirms the sign-in with a registered authenticator or security key. The identity provider validates the policy before granting access.

Common issues

Repeated fraudulent push requests intended to cause MFA fatigue
Lost authentication device without securely configured recovery methods
SMS-based codes vulnerable to interception or phishing
Legacy or service accounts that cannot complete interactive MFA

Two steps are not necessarily two factors

MFA combines evidence from different categories: something you know (a password or memorized secret), something you have (a registered security key or device), and something you are (a biometric characteristic). Entering two different passwords therefore does not produce two independent factors. A password plus a FIDO2 security key does. Biometrics used to unlock a passkey often protect the authenticator locally; that does not imply a fingerprint is transmitted to the remote website.

Passkeys can also support passwordless authentication through a cryptographic challenge tied to the legitimate website or application.

Why MFA methods have different strengths

SMS one-time codes are widely accessible but can be phished and are exposed to certain phone-number attacks.
App-generated TOTP codes may work offline, yet users can still be tricked into entering them on a phishing site.
Push approvals are convenient but repeated prompts can cause MFA fatigue; number matching adds helpful context.
FIDO2 security keys and passkeys bind cryptographic authentication to the relying-party origin, making them more resistant to traditional phishing.
Account recovery and emergency access should be strongly protected, or they can become a weaker path around MFA.

What MFA cannot protect on its own

MFA lowers the risk of stolen passwords being reused, but it is not a complete defense against hijacked sessions. Attackers may steal session cookies, exploit already-approved access or compromise endpoints. Session security, appropriate access policies and monitoring of anomalous sign-ins remain important.

Business deployments must accommodate administrators, service accounts, legacy applications and users without smartphones. The aim is not to force as many prompts as possible; it is to offer strong, usable authentication backed by well-controlled recovery procedures.

Key takeaway: MFA requires distinct factor categories; phishing-resistant FIDO2 and passkeys generally protect sign-ins more strongly than SMS codes.