Multi-factor authentication adds another requirement after a password or other primary sign-in method. This can stop many attacks that rely on a stolen password alone, but not every MFA method provides the same protection.
Why passwords alone are fragile
Passwords can be reused, phished, guessed, exposed in data breaches, or captured by malware. An attacker who obtains a correct password may be able to sign in from anywhere unless another control is required.
What a second factor changes
MFA requires evidence from another category, such as possession of a registered device or cryptographic key. A stolen password by itself is therefore insufficient in many attack scenarios.
SMS and voice codes
SMS and voice verification improve on password-only authentication but depend on the security of the phone number and telecom account. SIM-swap attacks, message forwarding, and social engineering can weaken this method.
Authenticator codes
Time-based one-time passwords generated by an authenticator app are not dependent on mobile-network delivery. They are still vulnerable to real-time phishing if a user is tricked into entering the current code into an attacker-controlled page.
Push approval
Push-based MFA is convenient but users should verify context rather than approving unexpected prompts. Number matching and additional sign-in context can reduce accidental approval of fraudulent prompts.
Security keys and passkeys
FIDO-based security keys and passkeys use cryptographic credentials associated with the legitimate service. They are designed to provide stronger phishing resistance because the credential is not simply a code that can be copied into a fake site.
Recovery is part of MFA security
A strong sign-in method can be undermined by a weak recovery process. Recovery codes, help-desk resets, backup phone numbers, and emergency accounts all deserve the same attention as the primary authentication method.
MFA does not remove the need to protect credentials
An attacker with an active session token may not need the password or second factor again. Privileged API keys may bypass interactive MFA entirely. Protect passwords, tokens, recovery codes, and sessions according to their role.