What is MFA (Multi Factor Authentication)?
Updated: 3 days ago
MFA, or multi-factor authentication, is an authentication method that requires evidence from two or more different factor types before access is granted. The important word is different. A password followed by a PIN is two steps, but both are knowledge factors, so that combination is not true multi-factor authentication.
MFA strengthens authentication by reducing reliance on a single credential. If a password is stolen, guessed or phished, an attacker still needs another independent factor. However, MFA is not a guarantee of security. Some MFA methods are far more resistant to phishing and account takeover than others.
What are the different MFA factors?
Authentication factors are usually grouped by the type of evidence they provide. MFA combines factors from different groups rather than simply asking for more information from the same group.
Something you know: a password, passphrase or PIN.
Something you have: a phone, hardware security key, smart card or other trusted authenticator.
Something you are: a biometric characteristic such as a fingerprint or facial recognition.
Contextual signals: device state, location, network or behavioural signals can influence access decisions, but these are not automatically independent MFA factors in every implementation.
How does MFA work?
A typical MFA login begins with an identity claim, such as a username or account. The service then asks for one authenticator and, where required, a second authenticator from a different factor type. The verifier checks the evidence before creating or continuing an authenticated session.
Enter or select the account identity.
Present the first authenticator, for example a password.
Present a second factor, for example a FIDO2 security key or trusted-device approval.
The service verifies both pieces of evidence.
If the required authentication policy is satisfied, access is granted.
Modern services may not request every factor on every visit. A trusted device, recent strong authentication or risk assessment can influence when re-authentication is required. This is one reason MFA should be understood as an authentication policy, not merely a screen that asks for a six-digit code.
MFA vs 2FA vs two-step verification
The terms MFA, two-factor authentication and two-step verification are often used loosely, but they are not perfectly interchangeable.
MFA: uses two or more different authentication factor types.
2FA: a specific form of MFA using exactly two different factors.
Two-step verification: describes a login with two verification steps, which may or may not use two different factor types.
For example, password plus PIN is two-step verification but not necessarily 2FA because both are things you know. Password plus a physical security key combines knowledge and possession, so it is genuinely multi-factor.
Which types of MFA are strongest?
The UK National Cyber Security Centre recommends preferring stronger MFA methods and ranks FIDO2 credentials ahead of challenge-based authenticator apps, code generators and message-based methods. The key distinction is phishing resistance.
FIDO2 security keys and platform credentials: strong phishing resistance because authentication is bound to the legitimate service.
Challenge-based authenticator apps: can be strong, but users can still be exposed to prompt fatigue or social engineering.
Authenticator-app one-time codes: stronger than a password alone, but a convincing phishing site can relay an OTP in real time.
Hardware code generators: useful in some environments, but generated codes can still be vulnerable to interception.
SMS, email and voice codes: useful as an additional barrier when stronger options are unavailable, but more exposed to interception, account recovery abuse and telecom or email compromise.
Why is phishing-resistant MFA different?
Traditional MFA often asks the user to copy a code or approve a prompt. A fake website can sometimes trick the user into supplying that code, while repeated push prompts can pressure somebody into approving a sign-in they did not initiate.
Phishing-resistant FIDO2 and WebAuthn credentials use public-key cryptography and are bound to the legitimate website or service. The user does not hand a reusable secret to the website. This makes credential relay through a lookalike phishing site substantially harder.
This is especially relevant to Zero Trust Networking, where strong authentication and authorisation decisions are fundamental to controlling access rather than trusting a connection simply because it originates from a particular network.
Does MFA protect you if your password is stolen?
Often, yes. That is one of MFA's main benefits. If an attacker has only the password, an independent second factor can prevent the login. But the outcome depends on the MFA method and the rest of the account-recovery process.
A stolen password may be stopped by a security key or authenticator approval.
A real-time phishing proxy may capture both a password and an OTP.
A user may accidentally approve a malicious push notification.
A stolen authenticated session token can sometimes bypass the need to repeat MFA.
Weak password-reset or account-recovery routes can undermine strong login protection.
Does MFA encrypt your internet traffic?
No. MFA proves identity or control of authenticators. It does not encrypt the connection itself. HTTPS and TLS protect data in transit, while encryption is a broader process for protecting data. These technologies can work together, but they solve different problems.
MFA and remote access
MFA is particularly important for internet-accessible services such as email, cloud administration, remote management and VPN access. A VPN can protect traffic between the user and VPN endpoint, but it does not prove that a stolen password belongs to the legitimate user. MFA adds that extra identity check.
For UK homes and small businesses, the broadband connection itself does not make MFA stronger or weaker. The authentication happens at the service layer. What matters is whether the user can reach the service and complete the chosen factor. SMS-based MFA may depend on mobile service, while authenticator-app codes and FIDO2 keys can work without receiving an SMS.
Techie Broadband practical MFA strength model
A useful way to assess MFA is to ask where an attacker could still succeed. Instead of counting login steps, examine the independence and attack resistance of each factor.
Factor independence: are the factors genuinely different, or are both knowledge-based?
Phishing resistance: can a fake site relay the factor to the real service?
Theft resistance: what happens if the phone, laptop or token is stolen?
Recovery strength: can an attacker reset the account through a weaker route?
Legacy access: is there an older protocol or application that can sign in without MFA?
Session protection: what happens if an authenticated browser session or token is stolen?
This explains why two accounts can both claim to use MFA yet provide very different real-world protection.
How to improve MFA security
Prefer phishing-resistant FIDO2 or passkey-based authentication where the service supports it.
Use challenge-based authenticator approvals with number matching or equivalent protections when FIDO2 is not practical.
Use authenticator-app codes before SMS or email codes where stronger methods are unavailable.
Never approve an unexpected authentication prompt.
Register more than one secure recovery method so losing a device does not force weak recovery.
Protect the email account used for password resets with strong MFA too.
Remove obsolete app passwords and legacy protocols that bypass modern authentication.
Review active sessions and trusted devices after any suspected account compromise.
Common MFA misconceptions
Two login screens automatically mean MFA: false. The factors must be independent types.
Biometrics are always sent to the website: false. Many modern systems verify biometrics locally to unlock a device-held credential.
MFA makes phishing impossible: false. Weaker OTP and push methods can still be phished or socially engineered.
SMS MFA is useless: false. It is generally better than password-only authentication, but stronger phishing-resistant options are preferable where practical.
MFA replaces strong recovery controls: false. Recovery is part of the authentication system and can become the weakest route.
Frequently asked questions about MFA
Is MFA the same as 2FA?
2FA is a form of MFA that uses exactly two different factor types. MFA can use two or more factors.
Does a password and PIN count as MFA?
Usually not. Both are knowledge factors, so using both does not create two independent factor types.
Is an authenticator app better than SMS?
Authenticator apps generally avoid some telecom-specific risks associated with SMS. However, ordinary OTP codes can still be phished. Phishing-resistant FIDO2 methods provide stronger protection where available.
Can MFA be hacked?
MFA can be bypassed or defeated in some circumstances, particularly through real-time phishing, push fatigue, stolen sessions, compromised recovery routes or weak legacy protocols. Strong phishing-resistant MFA reduces these risks.
Do passkeys count as MFA?
A passkey can provide multi-factor authentication when use of the device-held credential also requires local user verification such as a PIN or biometric, depending on the implementation and assurance requirements.
Key takeaway
MFA is not simply 'enter a password, then enter a code'. Genuine multi-factor authentication combines different types of evidence. The strongest practical implementations are designed to resist phishing, protect recovery routes and avoid weaker legacy paths that bypass the main login. For sensitive accounts, use the strongest MFA method the service and your devices can support.
To explore the related technical concepts used in this MFA (Multi Factor Authentication) guide, visit our broadband terminology guide.
