Multi-factor authentication (MFA) adds a verification step to a sign-in. Instead of relying only on a password, a service asks for evidence from another category, such as something you have or something you are.
Authentication factors
- Something you know: password or PIN.
- Something you have: security key or registered device.
- Something you are: fingerprint or face match.
Two passwords are not two different factors because both rely on knowledge.
Common MFA methods
Authenticator apps generate codes. Hardware security keys provide physical proof. Push notifications ask users to approve a sign-in. SMS codes are widely supported but can be vulnerable to phone-number takeover. Passkeys use public-key cryptography and can provide phishing-resistant sign-in.
How to enable MFA
- Open the account’s official security settings.
- Choose the strongest practical method.
- Register your device or key.
- Store recovery codes securely.
- Test recovery options.
Watch for unexpected prompts
Repeated sign-in prompts may mean someone has your password. Deny them, change the password and review account activity.
FAQs
Is SMS better than no MFA?
Often, but use a stronger option where available.
Can MFA be bypassed?
Some methods can be attacked; phishing-resistant methods and good recovery controls help.