MFA

In short

MFA stands for multi-factor authentication. It is the requirement that a person prove their identity with two or more factors from different categories before gaining access or completing an operation.

The word doing the work here is categories. Asking for two pieces of information a person knows is not MFA: it is just a longer password split across two fields.

A factor belongs to one of three categories

The classification is decades old and remains the only useful way to know whether a scheme is truly multi-factor.

• Something you know — a password, a PIN, a secret answer. It can be guessed, leaked, or phished.
• Something you have — a phone, a security key, an authenticator app. It can be stolen or, in the case of a phone line, transferred.
• Something you are — a biometric trait such as the face or the voice. It cannot be forgotten, and it cannot be changed if it gets compromised.

A scheme is multi-factor when it combines categories, not when it adds steps. Password plus security question are two steps in the same category. Password plus an app-based OTP are two categories.

2FA is a special case of MFA

The two terms get used as synonyms, and they are not quite the same. MFA is the concept: two or more factors from different categories. 2FA is the instance with exactly two.

In practice, almost everything called MFA in a product is 2FA. The distinction matters when a high-value operation justifies a third factor, and the vocabulary needs to be able to name that without inventing a new acronym.

Not all factors are worth the same

Treating MFA as a box to check is what produces schemes that are active and still get breached. The real design work is in deciding which factor covers what.

• SMS OTP — the weakest of those in use. The factor is tied to the phone line, and whoever gets the carrier to reassign it receives every code. This is the mechanism behind SIM swapping.
• App OTP — the code is calculated on the device and never travels over the mobile network. It removes the previous vector, and it can still be typed out to someone else.
• Push notification — more convenient, and exposed to approval fatigue: an attacker who already has the password fires off attempts until someone approves just to make the notifications stop. The known countermeasure is requiring the person to enter, on their phone, a number the sign-in screen displays, which forces them to look at where the attempt originated.
• On-device biometrics — the trait is compared locally and unlocks a credential. What travels to the server is not the face.
• [FIDO2](/glosario/fido2) or [passkey](/glosario/passkeys) credential — the credential is bound to the domain that registered it, so it cannot be used on a lookalike site. It is the only family on this list that resists phishing by design, not by the user's attention.

What MFA stops and what still gets through

This is the section that separates a scheme that works from one that just feels reassuring.

It stops this. A leaked password stops being enough. This is why MFA cuts off a credential stuffing attack at the root, where stolen combinations from other services get tried en masse.

It does not stop this. A real-time relay phishing attack captures the password and the code at the same moment and uses them before they expire. MFA was technically satisfied: the person handed over both factors — to the wrong site.

It does not stop this either. MFA is a gate control. A session that is already open and gets hijacked afterward never passes through it again, which is the problem continuous authentication addresses.

And there is a limit that comes before all of these: MFA protects an account, it says nothing about who opened it. A strong scheme built on a digital identity that was never properly verified rigorously protects an impostor's access.