Multi-Factor Authentication

Anyone logging into an online service must prove that they really are the account holder. Traditionally, this is done with a password. But passwords get guessed, intercepted, or stolen en masse when a company’s database is breached. With multi-factor authentication, the service therefore requires at least two different proofs. Only when both are correct does the account open. An attacker who only knows the password then faces a second locked door.

What a stolen password is still worth after that

Passwords are the weakest point of almost every system. Many people use the same password for multiple services. Once it appears in a leaked dataset, attackers try it automatically on hundreds of other sites. This method is called credential stuffing and runs fully automated, without any human reading along.

A second factor renders such mass attacks largely useless. The attacker would additionally need to possess the victim’s phone or security key. That’s no longer worthwhile if you want to attack millions of accounts at once. Major providers report that a second factor stops the vast majority of automated takeover attempts.

That’s why multi-factor authentication is now often mandatory, not just recommended. In the EU, banks must offer it for payments. Many companies require it of their employees, and cyber insurance policies demand it as a condition. AI services with access to company data also secure their accounts this way.

Knowledge, possession, and biometrics as three types of proof

Experts distinguish three categories of factors. The first is knowledge: something only you know, such as a password or PIN. The second is possession: something only you have, such as your phone or a small USB stick as a security key. The third is biometrics: something you are, such as a fingerprint or face.

What matters is that the factors come from different categories. Two passwords in a row are not true multi-factor authentication. Whoever guesses both still has everything. Two independent categories, on the other hand, force an attacker to crack them via two completely different paths.

The most common method today is a six-digit numeric code. An app on the phone generates it from a secret seed value and the current time. The server computes the same thing and compares. After thirty seconds, the code becomes invalid. SMS codes work similarly but are considered less secure, because attackers can take over phone numbers.

A common misconception is that a second factor protects against everything. On a fake login page, the victim types in both password and code, and the attacker immediately relays both onward. Only hardware keys and passkeys reliably prevent this, because they check which internet address they’re talking to.

From bank logins to passkeys on the smartphone

In online banking, this procedure has long been routine. You enter your login credentials and then confirm the transfer in an app or with a TAN device. Email providers, social networks, and gaming platforms also offer this feature. You’ll usually find it in the settings under security or login.

The term mostly appears in the news after major hacking attacks. It’s often reported that an account without a second factor was the point of entry. Security agencies such as Germany’s BSI explicitly recommend enabling it for all important accounts.

The current trend is toward passkeys. Here, a digital key resides on the phone or laptop, unlocked via fingerprint or face. Passwords and codes disappear entirely. Technically, it remains multi-factor authentication, since it combines possession of the device with biometrics. For users, though, it feels simpler than any typing.