What Is Multi-Factor Authentication? Not All MFA Is Equal

Microsoft researchers studied a large population of accounts showing suspicious activity and found that multi-factor authentication reduced the risk of compromise by 99.22%. For accounts whose passwords had already leaked in a breach, it still cut the risk by 98.56%. There is almost nothing else in security with numbers like that, which is why the advice to “just turn on MFA” has become close to universal.

But that advice hides something important, and it’s the reason people who did turn it on still get breached. Multi-factor authentication isn’t one thing. It’s a range of methods with wildly different strength, from one that a stranger can defeat by phoning your mobile network, to one that is cryptographically incapable of being phished. Most people are using the weak end and believe they’re protected by the strong end. This guide explains what MFA actually is, ranks the methods honestly, shows the three attacks that beat the weaker ones, and tells you which accounts to upgrade first.

1. What multi-factor authentication actually is

Multi-factor authentication means proving who you are with evidence from more than one category. The word doing the work is category, and there are only three of them.

The logic is simple. A password can be stolen from a long way away, by someone who never comes near you. Adding a second category means a thief who has your password still lacks something, and that something is usually a physical object in your pocket. Two-factor authentication, often shortened to 2FA, is just MFA with exactly two factors. In everyday use the terms are interchangeable.

One clarification that trips people up: your bank asking for your password and then your mother’s maiden name is not multi-factor authentication. Both are things you know, and both can be found, phished or guessed in the same ways. Mixing categories is the entire mechanism.

2. Does it actually work?

Yes, overwhelmingly, and it’s worth being precise about the evidence because this is a field full of recycled statistics.

You will see “MFA blocks 99.9% of attacks” quoted in a great many places. That figure traces back to a Microsoft blog post from 2019, and it has been repeated so often that it now floats free of its source. The better number comes from a 2023 Microsoft Research study, which analysed a large dataset of Azure Active Directory accounts showing suspicious activity, including accounts with known leaked credentials. It found that MFA reduced the risk of compromise by 99.22% across the whole population, and by 98.56% for accounts whose credentials had already leaked. More than 99.99% of MFA-enabled accounts stayed secure through the study period.

Note what that second figure means. Even when an attacker already has your password, MFA stopped the overwhelming majority of takeovers. If you read only one paragraph of this guide, read that one, and go and turn MFA on. Everything that follows is about the gap between 98% and 100%, which matters enormously for accounts that matter, and not very much for your supermarket loyalty card.

Turning on any MFA moves you from “a stolen password is game over” to “a stolen password is not enough.” That’s the biggest single step. Choosing the right kind is the second one, and almost nobody takes it.

3. The assumption that leaves people exposed

The assumption is that MFA is a switch. It’s on or it’s off, you did the responsible thing, and the account is now in the protected category. Every “turn on 2FA” campaign reinforces this, because a switch is easy to explain and a ladder isn’t.

But the methods sitting behind that switch differ by more than most people would guess. One of them can be defeated by a stranger convincing a mobile phone shop to move your number to their SIM card. Another can be defeated by annoying you at eleven at night. Another cannot be defeated by a convincing fake website at all, no matter how carefully the victim is deceived, because it is mathematically incapable of responding to the wrong domain.

Those aren’t variations in quality. They’re different security properties. Treating them as interchangeable is how someone ends up genuinely surprised that their account was taken over despite having 2FA enabled.

4. The MFA ladder, weakest to strongest

Rung one: SMS codes. A six-digit code by text. It’s the most common form of MFA in the world because it needs nothing but a phone number, and it is the weakest. Its central flaw is that your phone number isn’t really yours; it’s an account at a mobile carrier, and carrier staff can move it. It’s also delivered over telephone signalling infrastructure with known weaknesses. Still far better than nothing.

Rung two: codes from an authenticator app. The rotating six-digit numbers generated on your device. A meaningful upgrade, because the code is produced locally by maths rather than sent across a network, which removes SIM swapping and interception entirely. Microsoft’s own research noted that dedicated authenticator apps outperform SMS. But the code is still a secret you can be tricked into typing somewhere.

Rung three: push approval. A notification appears, you tap approve. Convenient, and it removes typing a code. It introduces a new weakness, though, which is that approving requires no thought and attackers can generate prompts at will.

Rung four: number matching. The login screen displays a two-digit number and you type it into the prompt on your phone. This closes the tap-by-accident problem neatly, because you can’t approve a request you didn’t initiate without being shown the number. CISA recommends it specifically as an interim measure for organisations that can’t yet move further.

Rung five: passkeys and hardware security keys. The only rung with a genuinely different security property, covered in its own section below.

5. The three attacks that beat weak MFA

SIM swapping. An attacker contacts your mobile carrier, impersonates you using personal details gathered beforehand, and has your number transferred to a SIM card they control. Every SMS code now arrives on their phone. No malware, no hacking, just a persuasive phone call to a support agent under time pressure, which is social engineering rather than a technical attack. Voice cloning has made these calls easier to carry off, as our guide on whether deepfakes are a real security threat explains.

Prompt bombing, also called MFA fatigue. The attacker already has your password, so they attempt to log in repeatedly, generating a stream of approval requests on your phone. Most people hold out. Some, at midnight, assume a glitch and tap approve to make it stop. One tap is all it takes. In Uber’s September 2022 breach, which the company attributed to the Lapsus$ group, the intrusion began with a compromised external contractor’s credentials, and early analysis indicated an MFA fatigue attack. Number matching exists precisely to kill this technique.

Adversary-in-the-middle phishing. The most important one, and the reason rungs one to four all share a ceiling. Instead of a static fake login page, the attacker runs a server that sits between you and the real site, relaying everything. You enter your password, it’s passed through. You enter your code or approve your prompt, that’s passed through too. The real service, satisfied, issues a session cookie, which is the pass that keeps you logged in. The attacker’s server copies it and loads it into their own browser. Microsoft has documented campaigns running this way, and has been clear that this is not a vulnerability in MFA. The attacker never defeats your second factor; they wait for you to pass it and steal the receipt. Our guide to how phishing works walks through this in detail.

One practical consequence is worth knowing now. If you ever suspect an account was taken over this way, changing the password is not enough on its own, because a stolen session can outlive it. Use the account’s “sign out of all devices” option too.

6. What CISA actually recommends

The US Cybersecurity and Infrastructure Security Agency has published guidance on this, and its position is clearer than most advice you’ll encounter.

Phishing-resistant MFA is the goal, and CISA identifies FIDO/WebAuthn as the most widely available form of it, with PKI-based authentication as an alternative that suits large organisations. Where that isn’t yet achievable, CISA recommends number matching as an interim measure, while stating plainly that it does not provide as strong protection as phishing-resistant MFA. The agency also lists the threats that weaker methods face, including push bombing, weaknesses in the SS7 telephone signalling protocol, SIM swap attacks, and phishing kits using reverse proxies to steal credentials, MFA codes and session cookies.

And CISA adds the sentence that keeps all of this in proportion: any form of MFA is better than none at all. That is the right note to hold on to. The ranking in this guide is for deciding what to improve, not a reason to switch anything off.

7. Why passkeys are different

Everything on rungs one to four has the same underlying shape: a secret that you receive and then hand over. It doesn’t matter whether the secret arrives by text, is generated by an app, or takes the form of tapping yes. If a convincing fake page can get you to hand it over, the method fails.

Passkeys and hardware security keys work differently. When you register one, your device creates a pair of mathematically linked keys. The private one never leaves your device, and the public one goes to the website. Signing in means your device proves it holds the private key without ever transmitting it. Crucially, that proof is bound to the website’s actual domain. A fake site at a lookalike address isn’t the registered domain, so your device will not produce a valid response for it. Not “you should notice and refuse” — it cannot.

That’s what phishing-resistant means, and it’s why this rung sits apart. A hardware key is a small physical device you plug in or tap. A passkey is the same cryptography stored on a phone or laptop and unlocked with a fingerprint, face or PIN, which is why signing in with one often feels faster than a password rather than slower. Our guide on how passwords actually get stolen covers why removing the password from the equation entirely helps so much.

Two honest caveats. Support is still uneven, so some sites you use won’t offer passkeys yet. And you need more than one way in, so register at least two methods, or a backup key, and keep your recovery codes somewhere safe and offline.

8. What to do this week, in order

First, your email account. Not your bank. Email is the recovery mechanism for everything else, so whoever controls it can reset your way into most of your other accounts. Give it the strongest method available, and if passkeys are offered, use them.

Second, anywhere money or identity lives. Banking, payment services, government portals, your password manager and your phone carrier account. That last one is easy to forget and directly protects you against SIM swapping.

Third, upgrade the method rather than just enabling it. On important accounts, move off SMS where something better is offered. Check the security settings of your top five accounts and note which rung each one is on. Most people have never looked, and the exercise takes about ten minutes.

Fourth, save your recovery codes properly. Most services give you a set of one-time backup codes when you enable MFA. Save them in your password manager or print them. People get locked out of their own accounts far more often than they get attacked, and losing a phone with no backup is a genuinely miserable afternoon.

Fifth, treat an unexpected prompt as an alarm. If you get an MFA request you didn’t trigger, never approve it, and understand what it means: someone has your password. Change it immediately, and change it anywhere you reused it. The prompt is not a glitch. It’s a warning, and it’s the most useful one you’ll ever get.

9. Frequently asked questions

What is multi-factor authentication in simple terms?

It’s proving who you are using evidence from more than one category: something you know such as a password, something you have such as your phone or a security key, and something you are such as a fingerprint. Two-factor authentication, or 2FA, is the same idea with exactly two factors.

Is SMS two-factor authentication safe?

It’s much safer than no MFA, and far weaker than the alternatives. SMS codes can be intercepted through SIM swapping, where an attacker persuades your mobile carrier to move your number to their SIM, and through weaknesses in telephone signalling. Use an authenticator app or a passkey instead where one is offered, but don’t turn SMS off if it’s the only option available.

Can hackers bypass two-factor authentication?

Some forms, yes. SIM swapping defeats SMS codes, prompt bombing defeats simple push approvals, and adversary-in-the-middle phishing defeats any method based on a code or approval by stealing the session cookie issued after you sign in. Passkeys and hardware security keys resist all three because they’re cryptographically bound to the genuine website’s address.

What is the most secure type of MFA?

Phishing-resistant MFA, meaning passkeys or hardware security keys built on the FIDO/WebAuthn standard. CISA identifies FIDO/WebAuthn as the most widely available phishing-resistant option and recommends number matching as an interim step for organisations that can’t adopt it yet.

What should I do if I get an MFA prompt I didn’t request?

Never approve it. An unexpected prompt means someone has your password and is trying to log in. Change that password immediately on the real site, change it anywhere you reused it, and sign out of all devices on that account.