Definition
Multi-factor authentication, often called MFA, is a security process that requires users to provide at least two different verification factors to gain access to an account or system. These factors typically fall into three categories: something the user knows (like a password), something the user has (like a phone or hardware token), or something the user is (like a fingerprint or facial scan). In practice, after entering a password, a user might be prompted to enter a code sent to their mobile device or scan their fingerprint to confirm their identity. Implementing MFA significantly enhances security by making it much harder for unauthorized individuals to access sensitive data, even if they manage to steal a password. A common example is logging into your bank account, where you enter your password and then receive a one-time code via text message. While often used interchangeably, two-factor authentication (2FA) is a subset of MFA, specifically using only two factors. MFA is a fundamental security control tested on certifications like CompTIA Security+ and ISC2 CISSP.