On this page
Definition
Multi-factor authentication is a security process that requires a user to verify their identity using two or more independent factors — such as a password, a device-generated code, or a biometric — before granting access to an account.
Simple explanation
A password alone is one proof: something you know. MFA adds a second (or third) proof from a different category, such as a code from your phone or a fingerprint, so that knowing the password isn't enough on its own.
This matters because passwords leak constantly, through breaches, phishing and reuse. An attacker with your stolen password still cannot log in without also having your phone or your fingerprint.
Why it matters
The overwhelming majority of account takeovers rely on a password being reused, guessed or phished. MFA is one of the single highest-impact security measures an individual or business can enable, because it blocks that entire attack path.
For businesses, MFA is now often a baseline requirement from insurers, auditors and customers — its absence is treated as a clear security gap rather than a minor oversight.
How it works
- 1First factorYou enter something you know, usually a password.
- 2ChallengeThe service prompts for a second factor tied to your identity.
- 3Second factorYou provide something you have (a code, an app approval) or something you are (biometric).
- 4VerificationThe service checks both factors independently before granting access.
- 5SessionAccess is granted, often with a trusted-device option to reduce repeated prompts.
Real examples
Products named for illustration only. Inclusion is not an endorsement.
- Google AuthenticatorGenerates time-based one-time codes as a second factor.
- YubiKeyA physical security key used as a possession-based factor.
- Microsoft AuthenticatorCombines push approval with biometric unlock for enterprise accounts.
- Bank SMS codesA widely used, if weaker, second-factor method via text message.
Advantages
- Blocks the vast majority of automated account-takeover attempts.
- Adds protection even after a password has already leaked.
- Available as a free or low-cost feature on almost all major platforms.
- Scales from personal accounts to enterprise-wide policy enforcement.
Limitations
- SMS-based codes can be intercepted through SIM-swapping attacks.
- Adds friction to login, which can encourage risky workarounds if poorly implemented.
- Users can be tricked into approving fraudulent push notifications ('MFA fatigue').
- Losing access to the second factor device can lock users out without a backup method.
Common misunderstandings
- ClaimMFA makes an account unhackable.RealityIt significantly raises the bar but doesn't stop all attacks, such as sophisticated phishing that captures both factors in real time.
- ClaimAny second step counts as strong MFA.RealitySecurity codes vary widely in strength — an authenticator app or security key is materially stronger than SMS.
Frequently asked questions
Is MFA the same as 2FA?
2FA is a specific case of MFA using exactly two factors; MFA is the broader term covering two or more.
Which MFA method is strongest?
Hardware security keys and passkeys are currently considered stronger than SMS or even authenticator app codes.
Should I enable MFA on every account?
Prioritise email, banking, and any account that can reset other passwords, since those are the highest-value targets.
What if I lose my phone with my authenticator app?
Most services offer backup codes generated at setup — store these separately and securely in advance.
Can MFA be bypassed?
Determined attackers use techniques like real-time phishing proxies, which is why security keys and passkeys are recommended over SMS.
The Tool Money Lab perspective
We treat MFA support as a non-negotiable baseline when reviewing any tool that touches money, identity or sensitive data — its absence is a hard mark against a product, not a nice-to-have.
Where possible, we recommend authenticator apps or hardware keys over SMS, since SIM-swapping has made text-message codes the weakest widely used option.
Conclusion
Multi-factor authentication requires more than one proof of identity, so a stolen password alone is no longer enough to break into an account.
It remains one of the cheapest, highest-impact security steps available, and the main decision left is choosing a strong second factor over a weak one.