MFA: second factor that blocks password theft

Multi-factor authentication (MFA) requires a second piece of evidence beyond your password. Think of it as a double lock: the password is something you know, and the second factor is something you have (like a phone generating a code or a hardware key) or something you are (like your fingerprint). Without MFA, a stolen password gives an attacker full access; with MFA, they still need that second factor, which is much harder to steal. For example, a one-time code from an authenticator app is far safer than an SMS code, which can be intercepted via SIM swapping.

In exam questions, watch for the trap that treats all MFA as equally strong. SMS codes are better than nothing but vulnerable to phishing and SIM swap attacks. Hardware keys (like YubiKey) or biometric checks are phishing-resistant and considered strongest. Another trick: MFA does not prevent password theft—it limits the damage. If a question asks which method is most secure, pick the one that cannot be phished. Also remember that MFA is not the same as two-step verification; the latter often uses the same type of factor twice (e.g., password plus security question), which is weaker.

To remember the key point, think of the acronym PHA: Password plus Have or Are. The second factor must come from a different category than the password. A quick self-test: if someone steals your password, can they still log in? If yes, you lack MFA. If they need a code from your phone or your fingerprint, you have MFA. The strongest MFA is one that resists phishing, so hardware keys or biometrics beat app codes, which beat SMS codes.