MFA stands for multi-factor authentication. It requires more than one distinct type of authentication factor, such as something you know plus something you have. A password and a PIN are both knowledge factors, so using both does not by itself make an authentication process multi-factor.
Simple explanation
MFA asks a user to prove identity with factors from different categories. Common categories are knowledge, possession and inherence—for example a password, a cryptographic device and a biometric characteristic in an appropriately designed system.
The second step should protect the account even if one factor is exposed. Not every two-step flow provides the same security or phishing resistance.
Technical context
NIST distinguishes the factor types and states that multiple instances of the same factor remain single-factor. A multi-factor authenticator can combine factors in one device, or a verifier can combine separate authenticators of different types.
Recovery, enrollment and session management must be secured too. Strong login can be undermined by weak recovery, approval fatigue or a stolen active session.
Practical example
A password followed by approval through a bound cryptographic authenticator combines knowledge and possession. A password followed by a security question uses knowledge twice and should not be described as MFA.
Sources and further reading
Technical statements were reviewed against these references. External pages may change after our review date.
- NIST SP 800-63-4: Digital Identity Guidelines — National Institute of Standards and Technology
- Secure Our World — Cybersecurity and Infrastructure Security Agency