What is multi-factor authentication (MFA)?

The three factor categories

Security people group proof of identity into three categories, and MFA only counts when it combines proof from at least two of them. Something you know is a password or PIN — information stored in your memory. Something you have is a physical item — a phone receiving a code, a hardware security key, an authenticator app installed on a specific device. Something you are is a biometric — a fingerprint or face scan, tied to your body rather than an object or a memory.

Two passwords, or a password plus a security question, are still just “something you know” twice — that is not MFA, however many steps it adds. Real MFA pairs categories: know plus have, or know plus are. That is also why it is sometimes called two-factor authentication (2FA) when exactly two categories are used; MFA is the more general term covering two or more.

Common MFA methods, ranked by strength

Not all “something you have” methods are equally strong, and the differences matter in practice.

• SMS text codes — convenient and better than a password alone, but the weakest common option: phone numbers can be hijacked via SIM-swapping, and codes can be intercepted or phished.
• Authenticator apps (generating time-based one-time codes) — the code is generated on the device itself rather than sent over the phone network, closing the SIM-swap gap.
• Push notifications — the app on your phone shows an “approve this login?” prompt, which is quick but can be defeated if a user is tricked into approving a login they did not request.
• Hardware security keys — a physical device plugged in or tapped via NFC, generally considered the strongest widely available option because the key material never leaves the device and can’t be phished the way a code can.

Why one control does so much work

Passwords fail constantly — reused across sites, guessed, phished, or leaked in a breach of some unrelated service. Once an attacker has a working password, MFA is the single control standing between them and your account, and it works because stealing a password is comparatively easy while also stealing your phone or your fingerprint is a different, much harder problem. This is why almost every major account-takeover prevention statistic and every serious security framework treats MFA as close to non-negotiable rather than optional hardening.

MFA in the cloud

Every major cloud provider strongly recommends, and often defaults to requiring, MFA on the accounts with the broadest power — the AWS account root user, an Azure or Google Cloud global admin, and any account holding billing or identity-management permissions. Losing control of one of those accounts is far more damaging than losing control of an ordinary user account, so providers treat MFA there as close to mandatory. Our identity and access management explainer covers the broader picture of how identities, permissions and authentication fit together, and enabling MFA is usually step one of putting that model into practice.

MFA is also a natural companion to zero trust security, which assumes no login should be trusted just because it presented a password — every access attempt is verified, and a second factor is one of the most direct ways to add that verification.

Setting up MFA sensibly

For most people, the practical order is: avoid SMS where a better option exists, prefer an authenticator app or a hardware key for anything important, and always record the backup/recovery codes a service offers when you enable MFA — losing your only second factor with no backup is a real way to lock yourself out of your own account. Cloud consoles typically walk you through this in account or security settings, and it takes only a few minutes to enable on an account that may otherwise sit unprotected for years.