What Is Multifactor Authentication? MFA Explained

What is multifactor authentication?

Multifactor authentication, or MFA, requires more than one distinct type of authentication factor. NIST groups factors as something you know, something you have, and something you are. MFA can combine separate authenticators or use one authenticator that requires another factor for activation. It adds a second kind of proof, but it does not make an account immune to compromise.

Authentication is the process of establishing that the person requesting access controls the authenticator or authenticators bound to an account. A username commonly identifies which account is involved. The authenticator supplies proof. That is why a username and password are not two authentication factors: the username is not the second proof.

What are the three authentication factor types?

NIST Special Publication 800-63B identifies three types:

• Something you know, such as a password or PIN.
• Something you have, such as a physical authenticator or a device that produces or receives an authentication output.
• Something you are, represented through a biometric comparison.

The categories matter more than the number of screens. A password followed by a PIN is still two “something you know” secrets. Requiring both may be two steps, but it is not multifactor authentication under NIST's definition because the factors are not distinct types.

NIST also makes an important distinction about biometrics: a biometric characteristic is not treated as an authenticator by itself in its framework. It is used with a physical authenticator, where the device provides “something you have” and the biometric match provides “something you are.”

Can MFA use one authenticator or two?

Yes. NIST describes two broad arrangements. A service can combine two separate single-factor authenticators, or it can use a multi-factor authenticator that needs two factors for one authentication event. The interface can look different even when the underlying goal is the same: require proof from more than one factor type.

Examples and labels vary by provider. A one-time passcode, hardware security key, authenticator application, or device biometric may play a role, but the actual factor arrangement depends on how the service implements it. A badge that says “MFA enabled” is less informative than knowing which factors and recovery paths the account uses.

What does MFA change, and what does it not change?

MFA means that compromising one factor is not automatically enough to complete authentication. It does not remove every threat. NIST's security discussion notes that knowledge factors may be disclosed, physical authenticators may be lost or stolen, biometric characteristics may be replicated or falsely matched, and people may be deceived into revealing information or granting access.

The practical lesson is flat: never approve an unexpected authentication request and never give another person a password, one-time code, or recovery code. Navigate to the service through its official application or address rather than an unsolicited sign-in link. For an organization-managed account, report an unexpected prompt or suspected compromise through the organization's established IT or security channel.

How does account recovery fit into MFA?

Recovery is part of the account's security design, not an improvisation after access is lost. NIST recognizes recovery approaches that include saved recovery codes, issued recovery codes, recovery contacts, and repeated identity proofing. A particular consumer service may offer only some of these options.

During setup, review the provider's official recovery instructions and keep recovery material in the manner the provider specifies. Do not send recovery codes to someone who contacts you, and do not use a third-party workaround to bypass the service's process. If an authenticator is lost, stolen, damaged, or no longer under your control, use the provider's official recovery route or contact the responsible organization administrator.

Is two-factor authentication different from MFA?

Two-factor authentication, often shortened to 2FA, uses two distinct factor types. It is therefore a form of MFA. “Multifactor” can describe authentication using two or more distinct types, while “two-factor” states the count explicitly.

The more useful question is not which abbreviation appears on the settings page. Ask what proof is required, what happens if one authenticator is unavailable, and which official recovery path applies. Those answers describe the control more accurately than the label alone.

DNS belongs to a different internet layer. Our guide to how DNS works explains how a domain name can lead a device toward address information; MFA explains how an account asks for proof before granting access.

Sources

• National Institute of Standards and Technology, Special Publication 800-63B: Authentication and Authenticator Management, accessed September 3, 2026. Used for the definitions of authentication, MFA, factor types, authenticator arrangements, biometric scope, threat categories, and recovery methods. Requirements tied to federal assurance levels are not presented as universal consumer-account rules.

An independent publication. Not affiliated with any prior owner of this domain.