What is MFA?

Multi-factor authentication requires more than one type of proof to log in: something you know, such as a password, plus something you have, such as a phone app, hardware key or one-time code, or something you are, such as a fingerprint.

MFA stops most password-only attacks. It can still be bypassed through push fatigue, SIM swapping, help desk social engineering and adversary-in-the-middle phishing that steals session cookies. Phishing-resistant methods such as FIDO2 security keys and passkeys close most of those gaps.