Multi-factor authentication (MFA) requires a second form of verification beyond your password before granting access to an account. Even if your password is stolen — through a breach, phishing, or malware — an attacker still can't get in without also having your second factor, whether that's your phone, an authenticator app, or a fingerprint.
Three Categories of Authentication Factors
- Something you know — a password or PIN
- Something you have — a phone, an authenticator app, or a physical security key
- Something you are — a fingerprint or face scan
True MFA combines factors from at least two different categories. Two passwords, or a password plus a security question, doesn't add the same protection since both fall in the "something you know" bucket.
Common Methods Compared
| Method | How it works | Strength | Weakness |
|---|---|---|---|
| SMS text code | One-time code by text message | Simple, no extra app needed | Vulnerable to SIM-swapping; weakest common option |
| Authenticator app | Generates a time-based code locally | Works offline, not tied to phone network | Lost device without backup codes can lock you out |
| Push notification | Approve/deny prompt to a trusted device | Fast and convenient | "Prompt bombing" — repeated requests hoping for a mistaken approval |
| Hardware security key | Physical device you tap or insert | Highly resistant to phishing and remote attacks | Cost; inconvenient if lost without a backup key |
Why SMS Is the Weakest Common Option
SMS-based MFA is far better than nothing, but it's considered the weakest widely available method mainly because of SIM-swapping — convincing a mobile carrier to transfer your number to an attacker's SIM, letting them intercept your codes directly. Where a service offers an authenticator-app or hardware-key alternative, those are generally preferable.
What MFA doesn't protect against
- Sophisticated real-time phishing, which can relay your password and one-time code to the real site instantly. Hardware keys using FIDO2/WebAuthn are specifically designed to resist this by cryptographically verifying the destination site.
- Prompt fatigue attacks, where someone with your password repeatedly triggers push prompts hoping you'll approve one out of confusion. Never approve a login prompt you didn't initiate.
- Losing access to your second factor without saved backup codes, which is why saving them at setup time matters.
Where to Enable It First
- Primary email account — often the recovery method for every other account you own
- Password manager — protects the master key to everything else
- Financial accounts — banking, payment services, investments
- Social media and cloud storage — frequent targets for fraud and impersonation
Setting It Up
Most services list MFA under Security or Login settings. The typical flow: choose a method (authenticator app is a solid default), scan a QR code or enter a setup key, confirm with a generated code, and save the backup/recovery codes somewhere secure and separate from the device running your authenticator app.
Frequently Asked Questions
Is SMS-based MFA still worth using?
Yes — it's meaningfully better than no second factor at all and blocks a large share of common automated attacks. Where an authenticator app or hardware key is offered as an alternative, those provide stronger protection against SIM-swapping specifically.
What if I lose the phone with my authenticator app?
This is why saving backup/recovery codes at setup matters — most services provide one-time codes for exactly this scenario. Without them, regaining access typically requires the service's account-recovery process.
Can multi-factor authentication be bypassed?
Sophisticated real-time phishing and prompt-fatigue attacks can bypass some methods. Hardware security keys using the FIDO2/WebAuthn standard are currently the most phishing-resistant widely available option.