Multi-factor authenticationMFA

Requiring two or more different kinds of proof to sign in.

For example, a person might type a password and then confirm a code from their phone or scan a fingerprint. A thief who steals the password still cannot get in.

Authentication using two or more independent factors: something you know, have, or are. Independent means the factors come from different categories, so a password plus a security question is still one factor, because both are things you know.

The three kinds of factor are:

• Something you know, such as a password or personal identification number (PIN).
• Something you have, such as a phone, a security key, or a passkey stored on a device.
• Something you are, such as a fingerprint or a face scan.

Common ways to supply a second factor include:

• One-time passcodes (OTPs) sent by text or email or generated by an authenticator app.
• Security keys and passkeys, which prove possession of a cryptographic key. A passkey unlocked with a fingerprint or face scan combines something you have with something you are in a single step.
• Biometrics, such as a face or fingerprint check on the device or through a verification service.

Multi-factor authentication sits next to terms that are easy to mix up:

• Two-factor authentication (2FA) is multi-factor authentication that uses exactly two factors.
• Authentication is the broader step of confirming a returning person, and multi-factor authentication is a stronger way to do it.
• Strong Customer Authentication (SCA) is Europe's regulatory version, which requires at least two independent factors for most online payments.

For a fuller walk-through, see What Is Multi-Factor Authentication?