How Does Multi-Factor Authentication Work?

Multi-Factor Authentication Explainer

Multi-factor authentication, or MFA, requires a user to present evidence from more than one independent factor category. Common categories are something the user knows, such as a password; something the user has, such as a security key or registered phone; and something the user is, represented by a biometric characteristic. Two passwords are not two factors because both are knowledge. The security benefit comes from forcing an attacker to overcome different kinds of controls rather than collecting two versions of the same evidence.

A typical sign-in begins with an account identifier and password. The identity service then requests proof tied to an enrolled authenticator. An authenticator app may generate a time-based one-time code from a shared secret. A push system may ask the phone to approve a challenge. A hardware security key can perform public-key cryptography and prove possession of a private key. The server validates the response, checks policy and risk signals, and creates a session with defined lifetime and privileges.

Not all factors resist the same attacks. SMS codes and typed one-time passwords can be phished by a fake site and relayed immediately to the real service. Repeated push prompts can trick a tired user into approving one. Phishing-resistant authenticators bind their cryptographic response to the legitimate site or verifier, so a lookalike domain cannot reuse it. Passkeys and standards-based hardware keys provide this property when implemented correctly. They also avoid giving the server a reusable authentication secret.

Biometrics usually unlock a local authenticator rather than being sent to every website. A fingerprint or face match allows the device to use a protected private key. The remote service receives cryptographic proof, not the raw biometric sample. This design limits exposure and lets the device enforce retry and liveness controls. Biometrics are not secret in the same sense as a password and cannot be reissued if widely compromised, so they work best as local activation of a possession factor.

Enrollment and recovery are part of the security boundary. An attacker who can add a new authenticator or convince support to reset MFA may bypass a strong daily sign-in. Services use reauthentication, notifications, waiting periods, recovery codes, identity proofing, or multiple existing authenticators. Users should register a backup method and store recovery material safely. Administrators monitor changes and high-risk recovery events rather than treating a successful factor check as the only signal.

MFA also interacts with sessions. After authentication, a stolen session cookie may grant access without repeating factors until it expires or is revoked. Sensitive actions can require step-up authentication, and device or network risk can shorten the session. Malware on an already unlocked endpoint can act as the user. MFA substantially reduces password-only account takeover but does not replace endpoint security, authorization, transaction confirmation, or fraud monitoring.

The system works by combining independent evidence and managing its lifecycle. Enrollment binds authenticators to an account, a challenge proves current control, policy determines how many and which factors are acceptable, and recovery handles loss without opening an easier bypass. The strongest everyday implementations prefer phishing-resistant public-key authenticators and keep fallback methods equally well protected. MFA raises the cost of account theft because one captured credential no longer completes the whole proof.