Multi-factor authentication (MFA) requires two or more different kinds of evidence to verify a login or sensitive action. Common factor categories are something you know, such as a password; something you have, such as a security key; and something you are, such as a biometric characteristic. Two passwords do not normally count as two different factors.
Common MFA methods
Authenticator apps generate time-based codes. Hardware security keys and passkeys can provide strong phishing resistance when implemented correctly. Text-message codes are often better than no second factor, but they can be vulnerable to SIM swapping and other attacks. The best supported method depends on the service and your risk.
Why it matters
If a password is stolen through phishing, reuse, or a data breach, MFA can make unauthorized access harder. It is especially important for email, banking, domain registrars, hosting dashboards, payment services, and administrator accounts because those accounts can be used to reset access elsewhere.
Secure your recovery process
- Save recovery codes in a secure location separate from the account.
- Register a backup method where appropriate.
- Keep account recovery email and phone details current.
- Never approve an unexpected login prompt just to make it disappear.
- Review active sessions and remove devices you do not recognize.
Protect against phishing
Attackers may try to trick users into entering codes on fake websites or approving repeated prompts. Check the domain before signing in and use a password manager or passkey where available. A legitimate support agent should not need your password or one-time code.
For teams
Require MFA for administrator and finance roles, remove access promptly when staff leave, use separate accounts instead of shared logins, and keep recovery ownership documented. Test account recovery before an emergency occurs.
MFA reduces risk but cannot prevent every attack. Combine it with unique passwords, updates, access reviews, and staff awareness. This guide is general security information.