Multi-Factor Authentication
also called MFA, 2FA
Requiring evidence from more than one category — something you know, have, or are — so a single stolen credential is insufficient.
The categories matter more than the count, and the strength varies enormously between implementations of the same nominal "second factor".
SMS codes — better than nothing and the weakest common option. Vulnerable to SIM swap, SS7 interception and, above all, phishing: a user will read the code to a convincing attacker.
TOTP apps — no SIM swap exposure, still phishable in real time. An attacker proxying the login collects the code and uses it within its window.
Push approval — convenient, and vulnerable to MFA fatigue, where an attacker triggers repeated prompts until someone approves to stop the noise. Number matching mitigates it.
Passkeys / FIDO2 / WebAuthn — phishing-resistant, because the credential is cryptographically bound to the origin. A user on a lookalike domain cannot authenticate to the real one no matter how convincing the page is. This is a categorical difference, not an incremental improvement.
The architectural conclusion: if MFA is being introduced now, introduce the phishing-resistant kind. It is stronger and lower friction — a biometric rather than typing a code from another device — which is the rare case where the security and usability objectives point the same way.