Also known as: MFA · 2FA · two-factor authentication
Multi-factor authentication (MFA) requires two or more independent categories of evidence to verify identity — typically something you know, something you have, and something you are — so that a stolen password alone is insufficient to gain access.
Not all MFA is equally strong. SMS codes and time-based one-time passwords can be intercepted or relayed in real time by a proxy phishing page, meaning they raise the bar without closing the gap. Push notifications are additionally vulnerable to fatigue attacks, where users approve a prompt simply to stop the flood.
Phishing-resistant factors — FIDO2 security keys and passkeys — bind the credential cryptographically to the legitimate site's origin, so a lookalike domain cannot obtain a usable response. This is the meaningful distinction when evaluating MFA, not merely whether MFA is enabled.
Passkey
A passkey is a phishing-resistant credential based on public-key cryptography that replaces passwords: the private key never leaves the user's device, and authentication is cryptographically bound to the legitimate site's domain.
Phishing
Phishing is a social-engineering attack in which an adversary impersonates a trusted party — typically via email, SMS, or a cloned website — to trick a victim into revealing credentials, authorising a payment, or installing malware.
Credential Stuffing
Credential stuffing is an automated attack that takes username and password pairs leaked from one breach and tries them en masse against other services, exploiting the fact that many people reuse the same password across sites.
Zero Trust
Zero trust is a security architecture that removes implicit trust based on network location, requiring every request to be authenticated, authorised, and continuously validated regardless of whether it originates inside or outside the corporate network.
Social Engineering
Social engineering is the manipulation of people into performing actions or disclosing information that compromises security, exploiting trust, authority, urgency, or helpfulness rather than technical vulnerabilities.