What Is Multi-Factor Authentication (MFA), and Why It's Everywhere Now
If you’re signing into more things with a phone prompt or a code these days, that’s multi-factor authentication — MFA for short — and it’s become close to universal for a good reason.
What “multi-factor” actually means
Section titled “What “multi-factor” actually means”Signing in with just a password proves one thing: that you know the password. MFA adds a second, different kind of proof — something you have (your phone, a YubiKey) or something you are (your fingerprint, your face) — so that knowing the password alone isn’t enough to get in.
The three broad categories are:
- Something you know — your password.
- Something you have — your phone (an authenticator app or a text code), or a physical key like a YubiKey.
- Something you are — a fingerprint or face scan.
MFA means using at least two of these together, which is why a stolen password on its own usually isn’t enough to get into an MFA-protected account.
Why it’s become the default everywhere
Section titled “Why it’s become the default everywhere”Passwords leak constantly — not usually because someone guessed yours, but because some unrelated website you used it on gets breached, and that same password gets tried everywhere else. MFA is what stops a leaked password from a completely different site from being usable against your work account.
What it looks like day to day
Section titled “What it looks like day to day”Most commonly, after entering your password you’ll get a prompt on your phone (via an authenticator app) to approve, or a text message with a short code to type in. You approve it, and you’re in — it adds a few seconds, not minutes.
Not all MFA is equally strong
Section titled “Not all MFA is equally strong”A text-message code is better than nothing, but it can still be intercepted or, more commonly, tricked out of you by a convincing fake login page. An authenticator app is stronger. A passkey or YubiKey is stronger still, because it can’t be phished the same way — it simply won’t work on a fake site at all. Where you have a choice, prefer the strongest option offered.
If you get an MFA prompt you didn’t trigger
Section titled “If you get an MFA prompt you didn’t trigger”Don’t approve it. An unexpected prompt usually means someone else has your password and is trying to get in — approving it hands them the second piece they need. Decline it, change your password, and contact support straight away.