Multi-factor authentication, or MFA, adds another kind of identity check to a password. This may involve a security key, a passkey, or a code from an authenticator app. The aim is to make a stolen password less useful on its own, while keeping a reliable recovery route for the real user.
Understand the idea
The methods are not all equally resistant to phishing. Some can be tricked through a copied sign-in page or an approval request you did not start. Choose stronger supported methods where practical, protect the process for adding a new method, and keep recovery information safely available.
- Factors
Combine distinct proofs, such as a password and a security key.
- Recovery
Keep a separate, protected way to regain access.
- Habit
Approve only the sign-in you intended to make.
A practical example
Imagine losing the phone that holds your authentication app. A previously prepared recovery method lets you regain access through the provider’s process. Without that preparation, a well-intended security setting can become a difficult support problem at the worst time.
What to do next
- Open the service's security settings through its official app or website.
- Choose a supported strong method that works on your devices and fits any workplace requirements.
- Register a suitable backup method or keep recovery codes protected and separate from the device you might lose.
- Sign out and test normal sign-in. Understand what happens if your phone is unavailable.
- Review existing recovery options, old devices, and weaker fallbacks. A forgotten fallback may bypass the method you just added.
How to check the result
Test sign-in and recovery before relying on the setup. Check that a backup method works and that someone with only the password cannot quietly add their own authentication method.
Does using a password and a security question count as two factors?
They are both things you know. Use a supported method that adds a different factor, and review the service’s recovery process so it does not undermine the protection.
Sources and useful guides
The following resources provide background and more detailed guidance. Use the sections that match your service and situation.
