What Is Multi-Factor Authentication (MFA)? Types Compared

Stolen passwords are cheap. Attackers buy them in bulk, guess them, or trick people into typing them into fake login pages. If a password is the only thing standing between a criminal and your email, payroll or bank portal, it is not standing for long.

Multi-factor authentication, usually shortened to MFA, is the fix most security agencies tell businesses to put in place first. But “turn on MFA” hides an important detail: the methods are not equally strong. A text message code and a hardware security key both count as MFA, yet one of them can be beaten by a convincing phishing email and the other cannot.

This guide explains what MFA is, ranks the common methods from weakest to strongest, and walks through the attack that has fooled employees at large companies: MFA fatigue.

What multi-factor authentication means

MFA asks you to prove who you are with 2 or more different types of evidence, called factors:

• Something you know: a password or PIN.
• Something you have: a phone, an authenticator app, a smart card or a hardware security key.
• Something you are: a fingerprint or face scan, usually used to open a device or key.

The rule is that the factors must be different types. A password plus a security question is still 2 things you know, so it is not true MFA. A password plus a code from an app on your phone combines knowledge and possession, so it is.

The US Cybersecurity and Infrastructure Security Agency (CISA) puts the benefit simply: if one factor, such as a password, is compromised, an attacker still cannot get in without the second one. That alone stops common attacks such as password spraying, where criminals try a few popular passwords against thousands of accounts.

You will also hear “two-factor authentication” (2FA). That is MFA with exactly 2 factors, which is what most business and consumer accounts use.

MFA methods ranked from weakest to strongest

CISA’s fact sheet on phishing-resistant MFA lists forms of MFA from strongest to weakest based on how exposed they are to 4 threats: phishing, push bombing, SS7 phone network exploits and SIM swapping. The table below follows that ranking, ordered from weakest to strongest.

CISA describes phishing-resistant MFA, meaning FIDO/WebAuthn and PKI-based methods, as the “gold standard.” For small and medium businesses that cannot move there right away, it says app-based codes, token codes and push with number matching are the best options.

Key takeaway: Any MFA is far better than none. But if you can only protect a few accounts with the strongest method, start with administrators, finance staff and anyone who can move money or change other people’s access.

Why SMS codes are the weakest option

Text message codes are popular because everyone has a phone number and nothing needs to be installed. They are also the easiest to defeat.

• SIM swapping: an attacker convinces your mobile carrier to move your number to a SIM card they control, and your codes go to them.
• Phone network weaknesses: CISA notes that attackers can exploit flaws in SS7, the signaling system that routes calls and texts, to grab codes sent by SMS or voice.
• Phishing: a fake login page can ask for the code and pass it to the real site in real time.

NIST, the US standards body, now classes phone-based codes (SMS or voice) as a “restricted” authenticator in its current digital identity guidelines, SP 800-63B-4. Restricted does not mean banned. It means organizations that rely on it should understand the risk, offer users a stronger alternative, and check for warning signs such as a recent SIM change before sending a code.

How MFA fatigue attacks work

MFA fatigue, also called push bombing, targets the simple “Approve or Deny” push prompt. The attack goes like this:

1. The attacker already has the victim’s password, often bought from a breach dump or captured by malware.
2. They try to log in again and again, and each attempt sends a push prompt to the victim’s phone.
3. The victim gets 10, 20 or 50 prompts, sometimes late at night.
4. Eventually the victim taps “Approve” to make it stop, or because they think it is a glitch.
5. Some attackers speed this up by messaging the victim while pretending to be IT support and telling them to accept the prompt.

This is not theoretical. In its public update on a September 2022 breach, Uber said an attacker had a contractor’s stolen password and repeatedly tried to log in, triggering push requests until the contractor accepted one.

The main defenses are:

• Number matching. The login screen shows a number and the user must type it into the app. Someone who did not start the sign-in has no number to enter. CISA recommends number matching as an interim measure when phishing-resistant MFA is not yet possible, and Microsoft began enforcing number matching for all Microsoft Authenticator push notifications from May 8, 2023.
• Extra context in the prompt, such as the app name and approximate location of the sign-in.
• Rate limits that block repeated push requests in a short window.
• A clear rule for staff: if you get a prompt you did not trigger, deny it and report it. IT will never ask you to approve a prompt over chat or the phone.

What makes passkeys and security keys phishing-resistant

Every method in the middle of the table shares a flaw: the user can be tricked into handing a code or approval to the wrong site. Phishing-resistant methods remove that choice.

Passkeys and FIDO2 security keys use public-key cryptography. When you register, your device creates a key pair tied to that specific website. When you sign in, your device checks that it is talking to the genuine site before it responds. A look-alike domain gets nothing, no matter how real it looks. NIST’s guidelines name WebAuthn/FIDO2 as a phishing-resistant approach, and list passwords, out-of-band methods and manually typed one-time codes as not phishing-resistant.

The FIDO Alliance describes 2 flavors of passkey:

• Synced passkeys are copied across your devices by a passkey provider, such as your phone platform or password manager. They are convenient and easy to recover.
• Device-bound passkeys stay on one piece of hardware, such as a USB or NFC security key. They are the strongest option for high-risk accounts.

For a deeper look, read our guides on what passkeys are and passkeys and the end of passwords.

How to roll out MFA in a small business

You do not need to protect everything perfectly on day 1. A staged plan works better.

1. List your critical accounts. Email, your identity provider, cloud admin consoles, banking, payroll, accounting, domain registrar and remote access tools come first.
2. Turn on MFA for every admin account now. Use security keys or passkeys for these if possible, and buy at least 2 keys per admin so there is a backup.
3. Set a company-wide default. For most staff, an authenticator app with number matching is a practical baseline. Disable SMS where your platform allows, or keep it only as a recovery fallback.
4. Centralize sign-in. Connecting apps to one identity provider through single sign-on means you enforce MFA once instead of app by app.
5. Plan for lost phones. Write down how someone proves who they are when they lose their device. Weak recovery, such as a help desk that resets MFA for anyone who calls, undoes the whole program.
6. Train for 10 minutes, not 2 hours. Show staff what a real prompt looks like, and drill the rule: deny prompts you did not start, and report them.
7. Review quarterly. Check for accounts without MFA, old phones still registered, and service accounts that bypass it.

A password manager pairs well with MFA, because it keeps passwords unique and many can store passkeys too. MFA is also a core building block of zero trust security, where every sign-in is verified rather than trusted by default.

Common MFA mistakes to avoid

• Leaving legacy sign-in methods open. Older email protocols and some VPNs accept just a password and skip MFA entirely. Turn them off.
• Exempting executives. Leaders are prime targets. They should have the strongest method, not an exception.
• Approving “remember this device” forever. Long sessions are convenient but give a stolen laptop or session cookie a long life.
• Relying on one admin’s phone. If the only person who can reset MFA loses their phone, you can be locked out of your own systems.
• Treating MFA as the finish line. Phishing kits that relay traffic can still steal session cookies from non-phishing-resistant methods. Monitor sign-ins for unusual locations and devices.

Conclusion

MFA is one of the cheapest, most effective security controls a business can adopt, and most platforms already include it. The real decision is which method. Use phishing-resistant passkeys or security keys for your most powerful accounts, number-matched app prompts or authenticator codes for everyone else, and treat SMS as a last resort. Then make recovery and staff training as strong as the login itself.

Sources

• CISA: Implementing Phishing-Resistant MFA (fact sheet) — MFA threats (phishing, push bombing, SS7, SIM swap) and the strongest-to-weakest ranking
• CISA: Implementing Number Matching in MFA Applications (fact sheet) — number matching as an interim defense against MFA fatigue
• NIST SP 800-63B-4: Authentication and Authenticator Management — SMS and voice as restricted authenticators, definition of phishing resistance
• FIDO Alliance: Passkeys — how passkeys work, synced versus device-bound passkeys
• CISA: Guidance on phishing-resistant and numbers matching MFA (alert) — publication date and context of CISA’s MFA guidance