Multi-factor Authentication (MFA)
Multi-factor authentication (MFA) requires two or more independent categories of evidence before granting access: something you know, something you have, and something you are. The word doing the work is independent. Two passwords are not two factors, and a one-time code delivered to a device an attacker already controls has quietly collapsed back into one.
| The three factor categories | Knowledge (password, PIN), possession (phone, security key, token), inherence (fingerprint, face) |
| Two-factor vs multi-factor | 2FA is exactly two; MFA is two or more |
| Strongest widely deployed form | Phishing-resistant hardware-backed keys using public key cryptography |
| Weakest common form | One-time codes delivered by SMS |
| Principal attacks | SIM swap, real-time phishing proxies, push fatigue, session token theft |
| Protects | An account that already exists |
| Does not establish | Who opened the account in the first place |
How it works
A single factor fails in a single way. Passwords are reused, guessed, phished and breached, and an attacker who obtains one obtains everything it protects. Adding a factor from a different category means one compromise is not enough — the attacker must defeat two mechanisms that fail differently.
Not all combinations are equal, and the gap between the strongest and weakest MFA is wider than the gap between weak MFA and no MFA at all.
| Method | Category | Principal weakness |
|---|---|---|
| SMS one-time code | Possession, nominally | SIM swap and interception; the code can be relayed by a phishing site in real time |
| Authenticator app code | Possession | Still a code a user can be persuaded to read out or type into a fake page |
| Push approval | Possession | Push fatigue — repeated prompts until the user approves one to stop them |
| Hardware security key | Possession | Cryptographically bound to the real site, so a proxy cannot relay it; loss of the key |
| Device biometric | Inherence | Releases a local key rather than transmitting the biometric; depends on the device |
The distinction that matters is whether a factor can be relayed. Anything a user can read and retype can be captured by a convincing fake page and replayed within seconds. Public-key methods bound to the origin cannot be, because the response is only valid for the site that requested it — which is why phishing resistance, not factor count, is the meaningful measure.
Why MFA matters for identity verification — and why it isn’t the same thing
MFA answers: is this the same person who set up this account? Identity verification answers: who is this person? Those are different questions, and conflating them produces a specific and common failure.
An account opened with a stolen or synthetic identity and then protected with strong MFA is a well-defended fraudulent account. Every subsequent authentication succeeds correctly, because the fraudster is the legitimate enrollee. MFA faithfully protects the wrong person, and does so indefinitely.
The other weak point is recovery. An MFA scheme is only as strong as what happens when someone loses their phone, and the recovery path is where account takeover concentrates. Attackers do not defeat the hardware key; they call support and claim to have lost it. Where recovery falls back to knowledge-based authentication, it falls back to information that breaches have made public.
This is why high-risk recovery increasingly uses document and biometric verification rather than questions — re-establishing identity against a government document and a live face, rather than asking what a credit report already knows. Identity 360 treats enrollment, authentication and recovery as one continuous problem, and synthetic and stolen identity controls exist because MFA cannot reach fraud that predates enrollment.
What MFA can’t do
It cannot tell you who enrolled. MFA binds access to a factor established at setup. If enrollment was fraudulent, MFA protects the fraud.
It does not stop real-time phishing unless it is phishing-resistant. A proxy site can relay a code or a push in the seconds it stays valid. Only origin-bound cryptographic methods break this.
It does not protect a session already established. Stolen session tokens bypass authentication entirely, because the authentication already happened.
It is only as strong as account recovery. Every scheme has a path for users who lose a factor, and that path is where attackers go.
Frequently asked questions
Is two-factor authentication the same as multi-factor authentication?
Two-factor authentication uses exactly two factors. Multi-factor means two or more, so 2FA is a subset of MFA. Both require the factors to come from different categories — a password and a security question are both knowledge factors and do not qualify.
Why is SMS considered weak MFA?
Because the possession factor can be moved. SIM swap attacks transfer a number to an attacker’s device, and a code the user reads and types can be relayed in real time by a phishing site. SMS is still substantially better than no second factor, but it is the weakest common form.
Does MFA prevent account takeover?
It raises the cost considerably, and it does not eliminate the risk. Attackers respond by targeting the account recovery path, stealing session tokens after authentication, or using real-time phishing proxies against factors that can be relayed.
Does MFA prevent new account fraud?
No. MFA verifies that the person signing in is the person who enrolled. If the account was opened with a stolen or synthetic identity, MFA protects that account exactly as designed. Preventing new account fraud requires verifying identity at enrollment.
Related reading
- Biometric authentication — the inherence factor, and why device biometrics release a key rather than send a fingerprint
- Account takeover fraud — what MFA is defending against, and where attackers go when it holds
- Knowledge-based authentication — the recovery fallback that breaches have undermined
- How biometric KYC enables secure onboarding — establishing identity at enrollment, which is what MFA assumes was done
