Multi-factor authentication, or MFA, means a login needs more than one kind of proof. A password alone is not enough; the account also asks for something like a code, device approval, authenticator app, fingerprint, or security key.
Does this affect you?
Use this for email, banking, social media, cloud storage, shopping, work accounts, and any modern app or website offering MFA or two-factor authentication.
How multi-factor authentication works
The factors come from different categories. MFA combines at least two of them.
- Something you know is usually your password or passphrase.
- Something you have is a phone, authenticator app, one-time code, passkey device, or physical security key.
- Something you are is a biometric factor such as a fingerprint or face scan, often used to unlock a device.
- A login succeeds only after more than one factor is accepted. If a password leaks, the attacker still needs the second proof.
- Different second factors have different strength. Text codes are better than no MFA, while authenticator apps and security keys resist more attacks.
Choose the right MFA option
Start with what the account supports, then upgrade where possible.
- SMS text codes are easy and widely available, but they can be vulnerable to SIM swap attacks.
- Authenticator apps such as Google Authenticator generate codes on the device without relying on your phone number.
- Push approvals are convenient, but approve only sign-ins you started yourself.
- Physical security keys are among the strongest options because they can resist many phishing pages.
- Backup codes should be saved somewhere safe, such as a password manager or offline copy.
More control
Protect email first
Your primary email can reset passwords for many other accounts. Turn on MFA there before nearly anything else.
Then protect money and identity accounts
Banking, payment apps, cloud storage, phone carrier, tax, Social Security, and password manager accounts should be next.
MFA is not optional decoration
It is one of the highest-value account protections because stolen passwords are common and password reuse is still widespread.
Sources
- CISA – Multi-Factor Authentication (2025)
- NIST – Digital Identity Guidelines: Authentication (2025)
- Google Account Help – Turn on 2-Step Verification (2025)