Multi-factor authentication (MFA)

MFA asks for proof from two or more different categories: something you know (a password, a PIN), something you have (a phone, a hardware key), something you are (a fingerprint, a face). Two passwords is not MFA, and neither is a password plus a security question, because both live in the same category and leak the same way. Note that no password is required anywhere in that definition: a passkey unlocked by a face is already two factors, which is why passwordless and MFA are not opposites.

Do not rank the methods on one line, because they fail in different ways. SMS and emailed codes are phishable and, for SMS, SIM-swappable. TOTP from an authenticator app is phishable too: a real-time proxy relays the code within its 30-second window. Basic approve/deny push is fatigue-prone, since a tired human tapping 'yes' at 2am is the whole attack, though push with number matching and origin context is considerably better. WebAuthn security keys and passkeys are the only ones in the list that are phishing-resistant by construction.

Reach for it anywhere an account holds money, customer data, or admin powers. The shape that people actually tolerate: require it for admins and org owners, offer it to everyone else, remember trusted devices for 30 days, and use step-up authentication so the prompt appears before dangerous actions (changing payout details, adding an API key) rather than on every single login.

Two gotchas. The hard part is not enrollment, it is recovery: ship single-use recovery codes and a documented support path on day one, or you will hand-verify locked-out users forever. And MFA does nothing for a session that has already been stolen. A lifted session cookie or access token walks past the login check entirely, so the protection only extends past sign-in if sensitive actions demand reauthentication at the moment they happen.