What is Multifactor Authentication (MFA) (MFA)?
Multifactor Authentication (MFA) is the practice of requiring a user to present two or more independent proofs of identity before granting access. Each factor must come from a different category: something you know, something you have, or something you are.
What it is
MFA is a security control, not a product. It is a requirement that authentication must combine at least two factors from distinct categories:
- Something you know: a password or PIN
- Something you have: a hardware security key, a TOTP app, or a device-bound passkey
- Something you are: a fingerprint, face scan, or behavioral biometric
The factors must be independent. If one is compromised, the attacker still cannot authenticate without the others.
Phishing-resistant MFA is a stricter subset. It uses cryptographic binding between the credential and a specific origin, so a fake login page cannot capture and replay the second factor. Hardware security keys (FIDO2/WebAuthn) and passkeys are the main phishing-resistant options. SMS one-time codes and TOTP codes are MFA but are not phishing-resistant.
Why it matters
Stolen passwords are the most common entry point in breaches. MFA blocks most credential-stuffing and phishing attacks even when a password is exposed. Regulators and cyber-insurance underwriters increasingly require MFA for privileged accounts, remote access, and sensitive data systems. Phishing-resistant MFA is now specifically required or recommended by frameworks such as NIST 800-63B and US federal guidance.
How tools address it
Products in the MFA and Passwordless category implement MFA in different ways. Some anchor identity to a registered device using asymmetric cryptography, removing the password entirely. Others add step-up authentication at the point of risk, prompting for a second factor only when context looks suspicious. Hardware token solutions bind the second factor to a physical object the user must possess. Biometric solutions use a fingerprint, face, or behavioral pattern as the inherent factor. These tools sit within the broader Identity and Access Management (IAM) and Access Management ecosystems and often integrate with Single Sign-On platforms.