What it means
Multifactor authentication combines different kinds of evidence, commonly something you know, something you possess, or something you are. A password and another password do not provide different factors. Some authenticators combine factors within one device, such as a cryptographic key that requires local activation with a PIN or biometric check.
Methods differ in what they resist. A one-time code can be relayed through a convincing fake sign-in page, and an unexpected approval prompt can pressure someone into accepting. Phishing-resistant cryptographic methods bind authentication to the legitimate verifier. MFA improves sign-in assurance but does not repair excessive access or automatically protect an already stolen session.
AN ILLUSTRATIVE SCENARIO
A retailer administrator account
A retailer requires stronger authentication for staff who manage its online store. It tests a security-key-based method, enrolls a protected backup authenticator, and documents recovery for a lost key. The rollout includes supplier accounts and alternate administration pages rather than only the main sign-in screen. Staff are taught to report unexpected prompts. The team then checks whether existing sessions and recovery channels could bypass the intended protection.
Put it to work
- Identify the factors and phishing resistance of the actual method, rather than relying on the label “MFA” in a product setting.
- Prioritize high-impact accounts, cover every relevant sign-in path, and plan secure enrollment, replacement, recovery, and emergency access.
- Test rejection when a required factor is missing, verify recovery controls, and monitor enrollment changes and suspicious authentication activity.
How to check your work
With a test account, confirm that possession of the password alone is insufficient and that alternate paths enforce the intended assurance. Document exceptions and demonstrate how a lost authenticator is revoked.
Connect the ideas
- Authentication
The act of verifying a claimed identity with authenticators such as passwords, passkeys, or certificates.
- Phishing
Social engineering that tricks a person into revealing authenticators or approving a transaction they did not intend.
- Account recovery
The process that restores access when authenticators are lost, which can become the weakest authenticator.
- Session
State linking multiple requests; an authenticated session associates later requests with a previously authenticated identity until it expires or is revoked.