What is MFA (Multi-Factor Authentication)?

Multi-Factor Authentication (MFA) is an authentication approach that requires a user to demonstrate control of two or more distinct authentication factors. These factors are typically categorized as something the user knows, something the user has, or something the user is. By requiring multiple factors, MFA reduces reliance on a single authenticator and provides additional protection against unauthorized access.

MFA can be implemented through a combination of separate authenticators, such as a password and a one-time password (OTP) generator, or through a single multi-factor authenticator that combines possession of a cryptographic key with a PIN or biometric comparison. [1]

Current NIST guidance distinguishes between authentication methods according to their security properties, including resistance to phishing, replay attacks, and authenticator compromise. Not all MFA methods provide the same level of security, and the presence of multiple factors does not automatically make an authentication process phishing-resistant. [1]

For organizations designing authentication journeys, MFA is an important mechanism for establishing confidence that a user controls the authenticators associated with their account. The appropriate implementation depends on the required authentication assurance level, the sensitivity of the interaction, and the threats the authentication process is intended to address.

Multi-Factor Authentication at a glance

Why is Multi-Factor Authentication important?

MFA addresses a fundamental limitation of single-factor authentication: compromise of one authenticator may be sufficient for an attacker to gain unauthorized access.

For example, a password may be exposed through phishing, credential theft, or another form of compromise. Where that password is the only authentication requirement, successful use of the stolen credential may allow an attacker to authenticate.

MFA introduces an additional requirement that the attacker must satisfy.

NIST's Authentication Assurance Levels reflect this distinction. AAL1 permits single-factor authentication, while AAL2 and AAL3 require proof of two distinct authentication factors. [1]

However, requiring multiple factors does not eliminate all authentication risks.

An attacker may attempt to intercept authentication responses, compromise an authenticator, exploit account recovery processes, or impersonate a legitimate authentication service.

The security benefit of MFA therefore depends on both the independence of the factors and the technical properties of the authentication methods used.

How does Multi-Factor Authentication work?

MFA requires a user to prove control of at least two distinct authentication factors during an authentication process.

A typical MFA process using separate authenticators has four stages:

1. Identify the account. The user begins an authentication attempt, typically by providing an account identifier or initiating an authentication process associated with an existing account.
2. Authenticate with the first factor. The user provides evidence of control over an authenticator, such as entering a password.
3. Authenticate with an additional factor. The user demonstrates control of a second, distinct factor, such as an OTP-generating authenticator or cryptographic security key.
4. Verify the authentication evidence. The verifier evaluates the authentication responses against the applicable requirements before completing authentication.

Not every MFA process requires two separate user interactions.

For example, a multi-factor cryptographic authenticator can combine possession of a private cryptographic key with local activation through a PIN or biometric comparison. The authenticator then performs a cryptographic operation that the verifier can validate. [1]

The defining requirement is not the number of screens, prompts, or verification steps. It is whether the authentication process establishes control of two or more distinct factors.

What are the three types of authentication factors?

NIST SP 800-63B-4 recognizes three categories of authentication factors: knowledge, possession, and inherence. [1]

Knowledge factors: Something you know

Knowledge factors involve information known to the user.

Examples include:

• Passwords and passphrases; and
• Memorized secrets; and
• PINs used to activate an authenticator.

A password can serve as an authentication factor when verified by the authentication system. A PIN can also function as an activation secret for a multi-factor authenticator.

Two passwords do not constitute MFA because both belong to the knowledge category.

Possession factors: Something you have

Possession factors establish that a user controls a particular physical or software-based authenticator.

Examples include:

• Cryptographic security keys;
• Devices containing cryptographic authentication keys;
• OTP-generating authenticators; and
• Devices used for out-of-band authentication.

Possession is not established merely because a user knows information about a device. The authentication process must demonstrate control of the relevant authenticator.

NIST distinguishes between single-factor and multi-factor possession-based authenticators according to whether an additional activation factor is required. [1]

Inherence factors: Something you are

Inherence factors are based on biometric characteristics associated with a person.

Examples include:

• Fingerprint characteristics;
• Facial characteristics; and
• Iris characteristics.

Under NIST guidance, biometric characteristics are not considered authenticators by themselves. Biometric comparison must be used with a physical authenticator, and implementations are subject to additional requirements concerning presentation attacks, matching performance, and secure processing. [1]

A biometric comparison used to activate a cryptographic authenticator can provide an inherence factor as part of MFA.

What are the common MFA methods?

MFA can be implemented through different combinations of authenticators. These combinations do not necessarily provide equivalent protection against authentication attacks.

Password and SMS OTP

A user enters a password and then provides a one-time code delivered by SMS.

The password serves as a knowledge factor, while the SMS-based out-of-band authentication mechanism can provide a possession factor.

NIST classifies authentication using the public switched telephone network (PSTN), including SMS and voice delivery, as restricted due to security risks associated with telephone-number control and delivery mechanisms. [1]

Password and authenticator application

A user enters a password followed by a one-time code generated by an authenticator application.

Time-based OTP authenticators generate codes from a shared secret and a time-dependent input. The verifier independently calculates or validates the expected response. [1][3]

Although this combination provides MFA, manually entered OTPs are not phishing-resistant because an attacker may capture and relay a valid authentication response.

Password and cryptographic security key

A user enters a password and authenticates with a security key using a cryptographic challenge-response protocol.

Where the protocol provides appropriate binding to the legitimate verifier, cryptographic authentication can offer phishing resistance.

The security properties depend on the authenticator, its configuration, and the protocol being used. [1][2]

Multi-factor passkeys

Passkeys are FIDO credentials that use public-key cryptography to authenticate a user without transmitting a traditional password.

When the cryptographic authenticator also requires an activation factor, such as a PIN or biometric comparison, the authentication process can provide MFA.

NIST treats synced passkeys as syncable authenticators. Because their private keys can be exported, they can be used at AAL1 and AAL2 but not at AAL3. [1]

What is the difference between MFA and Two-Factor Authentication?

Two-Factor Authentication (2FA) is a specific form of Multi-Factor Authentication (MFA). While 2FA requires exactly two distinct authentication factors, MFA is the broader term for authentication using two or more factors.

In practice, the terms are often used interchangeably because many MFA implementations use exactly two factors. However, neither approach is inherently more secure based on the number of factors alone. The level of protection depends on the authenticators, protocols, and security controls used. [1]

How does MFA work with passwordless authentication?

MFA and passwordless authentication describe different characteristics of an authentication process.

MFA describes the requirement to establish control of multiple authentication factors.

Passwordless authentication refers to processes that do not require the user to authenticate using a traditional password.

These approaches can operate together.

For example, a multi-factor passkey can use a cryptographic key held by a device and an additional activation factor, such as a fingerprint comparison or PIN.

The cryptographic key provides the possession factor, while the biometric characteristic or PIN provides an additional factor. [1][2]

However, not every passwordless authentication process constitutes MFA. A single-factor cryptographic authenticator can provide passwordless authentication without satisfying a multi-factor requirement.

This distinction matters when organizations must meet a specific authentication assurance level.

Is all Multi-Factor Authentication phishing-resistant?

No.

Phishing resistance is a technical property of the authentication protocol, not an automatic consequence of using multiple factors.

Some MFA methods rely on authentication responses that a user can manually enter into a website or application. An attacker operating a fraudulent authentication page may be able to capture and relay those responses to a legitimate service.

This can affect OTP-based MFA, including codes delivered by SMS or generated by authenticator applications.

NIST identifies two approaches capable of providing phishing resistance: channel binding and verifier name binding. [1]

WebAuthn provides an example of verifier name binding. Authentication is cryptographically associated with the legitimate relying party, helping prevent an authenticator's response from being used by an impersonating website. [2]

Consequently, a phishing-resistant multi-factor cryptographic authenticator provides different security properties from an OTP-based MFA implementation.

Organizations should evaluate authentication methods against the threats they are intended to mitigate rather than assume that all MFA methods offer equivalent protection.

What is Adaptive Multi-Factor Authentication?

Adaptive MFA uses contextual or risk-based information to influence when additional authentication controls are applied.

Rather than requiring the same authentication journey for every interaction, adaptive approaches can use information about the user, device, network, or activity to determine whether additional assurance is appropriate.

NIST recognizes risk-based or adaptive authentication techniques that examine information such as IP addresses, geolocation, request timing, and browser metadata. [1]

For example, a service might identify an authentication attempt from an unexpected device or location and require additional authentication before allowing a sensitive action.

The distinction between MFA and adaptive authentication is important:

• MFA establishes the requirement for multiple distinct authentication factors.
• Adaptive authentication uses contextual information to help determine the appropriate authentication response.

A contextual risk assessment does not itself constitute an authentication factor.

Where MFA is required by regulation, policy, or the applicable assurance level, a low-risk assessment does not automatically remove that requirement.

Does MFA improve security?

MFA can reduce reliance on a single authentication factor, but the security of the overall process depends on its implementation.

NIST identifies several threats relevant to authentication systems, including authenticator theft and duplication, eavesdropping, phishing, social engineering, online guessing, endpoint compromise, and authentication fatigue. [1]

MFA can make some attacks more difficult because an attacker must satisfy an additional authentication requirement.

However, different MFA methods address these threats in different ways.

For example, an OTP-based MFA process may provide additional protection against password compromise but remain vulnerable to phishing attacks that relay authentication responses.

A phishing-resistant cryptographic authenticator may provide stronger protection against verifier impersonation, but other risks, including authenticator loss and account recovery weaknesses, still require appropriate controls.

MFA should therefore be considered one component of a broader authentication security architecture rather than a guarantee against account compromise.

Standards and regulatory considerations for MFA

Authentication requirements vary according to the standards framework, industry, and jurisdiction.

NIST Digital Identity Guidelines

NIST SP 800-63B-4 defines technical authentication requirements across three Authentication Assurance Levels.

Authentication Assurance Level 1 (AAL1)

AAL1 provides basic confidence that a user controls an authenticator associated with an account. Single-factor authentication is permitted, although NIST recommends that MFA options be offered.

Authentication Assurance Level 2 (AAL2)

AAL2 requires proof of possession and control of two distinct authentication factors. Verifiers operating at AAL2 must offer a phishing-resistant authentication option.

Authentication Assurance Level 3 (AAL3)

As a result, syncable authenticators such as synced passkeys can’t be used at AAL3.

These requirements apply within the scope of NIST's digital identity framework and should not be treated as universal legal requirements for all organizations.

EU strong customer authentication requirements

Within the European Economic Area, the revised Payment Services Directive (PSD2) and Commission Delegated Regulation (EU) 2018/389 establish strong customer authentication (SCA) requirements for relevant payment services.

Together, they define SCA around two or more independent elements categorized as knowledge, possession, and inherence, with requirements intended to preserve the reliability of the remaining elements if one is compromised. [4]

For qualifying remote electronic payment transactions, the framework also establishes requirements for dynamically linking authentication to the transaction amount and payee.

The EU has also agreed a new Payment Services Regulation (PSR) and a third Payment Services Directive (PSD3) to replace PSD2, following a provisional political agreement in November 2025. Until the PSR applies, PSD2 and Regulation 2018/389 remain the reference for SCA.

Authenticator security and lifecycle management

NIST SP 800-63B-4 also establishes requirements for authenticator binding, replacement, revocation, recovery, and session management. [1]

These controls are important because authentication assurance depends on more than the initial login.

An organization must also consider how authenticators are enrolled, how users regain access when an authenticator is lost, and how compromised authenticators are invalidated.

Does MFA always require an additional authentication step?

No.

An authentication process can satisfy MFA requirements without presenting two separate challenges to the user.

For example, a multi-factor cryptographic authenticator may combine possession of a private key with local activation through a biometric comparison or PIN.

The authentication process can then be completed using a cryptographic challenge-response protocol.

This distinction is particularly relevant to passkeys, where an authentication interaction may involve a single device-mediated process while still establishing control of multiple authentication factors. [1][2]

However, the number of visible steps should not be used to determine whether MFA has occurred. The relevant question is whether the authentication process meets the applicable factor and authenticator requirements.

What happens when an MFA method is unavailable?

Users may be unable to complete MFA when an authenticator is lost, damaged, unavailable, or otherwise inaccessible.

NIST's authentication guidelines address authenticator recovery and replacement as part of the authentication lifecycle. [1]

Depending on the assurance requirements and available mechanisms, recovery may involve:

• Using another authenticator already bound to the account;
• Entering a saved or issued recovery code;
• Confirming access through a designated recovery contact; or
• Repeating identity proofing, where the account was identity-proofed in the first place.

Once access is restored, the user binds a replacement authenticator. [1]

NIST’s guidance also says one authentication factor shouldn’t be usable to obtain an authenticator of a different factor. For example, a password alone shouldn’t be enough to get a fresh set of recovery codes. [1]

Organizations should therefore design authentication and account recovery as connected security processes.

What should organizations consider when implementing MFA?

Effective MFA implementation requires selecting appropriate authentication methods and designing the surrounding authentication lifecycle.

Determine the required authentication assurance. Start by assessing the sensitivity of the service or interaction and identifying applicable assurance, security, and regulatory requirements. NIST's Digital Identity Guidelines provide a structured framework for making these decisions. [1][5]

Evaluate the security properties of each authenticator. Authentication methods differ in their resistance to phishing, replay attacks, authenticator compromise, and other threats. Selecting MFA should involve more than counting the number of factors.

Consider phishing-resistant authentication. Where phishing is a significant threat, organizations should evaluate cryptographic authentication methods designed to resist verifier impersonation.

Design secure enrollment and recovery processes. The initial enrollment, replacement, revocation, and recovery of authenticators should preserve the intended level of authentication assurance.

Account for accessibility and user experience. Authentication requirements should consider different devices, capabilities, and customer circumstances. NIST includes accessibility and customer experience considerations alongside its technical authentication requirements. [1]

Consider contextual and risk-based controls. Risk information may help determine when additional authentication is appropriate, provided that mandatory authentication requirements are preserved.

Evaluate authentication controls over time. Threats, authenticators, and user needs evolve. Authentication systems should be assessed periodically to ensure that the selected controls remain appropriate.

The objective is to establish authentication processes that provide the required assurance while remaining accessible, manageable, and appropriate to the interaction being protected.

Related authentication terms

Two-Factor Authentication (2FA): A form of MFA requiring exactly two distinct authentication factors.

Authentication factor: A category of evidence used to establish authentication, generally classified as knowledge, possession, or inherence.

Authenticator: Something a user possesses or controls and uses to authenticate, such as a password, cryptographic security key, or OTP-generating device.

One-Time Password (OTP): An authentication secret intended for use in a single authentication event.

Passkey: A FIDO authentication credential using public-key cryptography that can support passwordless, phishing-resistant authentication.

Passwordless authentication: Authentication that does not require a traditional password.

Adaptive authentication: An approach that adjusts authentication requirements based on contextual or risk information.

Step-up authentication: Additional authentication performed when a higher authentication assurance level is required.

Phishing-resistant authentication: Authentication using protocols designed to prevent an impostor verifier from obtaining authentication output that can successfully be reused against the legitimate verifier, without relying on the user to spot the impostor

Authentication Assurance Level (AAL): A NIST classification describing the strength and requirements of an authentication process.

Strong Customer Authentication (SCA): A regulatory authentication framework used in European payment services that requires independent authentication elements and, where applicable, additional transaction-specific protections.

Frequently asked questions