MFA Published 2021-08-23 Updated 2026-05-09 6 min read

Why use Multi-factor Authentication?

Cybercriminals have billions of leaked records to play with. A second factor — especially a hardware-bound one — is what cuts off the long tail.

The problem with passwords

The wider set of threat classes an authentication control has to answer for is covered in the cyber-security threats overview. Every leaked password lives forever. The Have-I-Been-Pwned project alone tracks roughly twelve billion exposed credentials. Attackers don’t need to break your password — they just try a list of thirty thousand of yours and someone else’s, and one of them works. This is credential stuffing, and at scale it works often enough to be worth running 24/7 against most consumer services.

What a second factor adds

Multi-factor authentication asks for proof from at least two of these categories:

Knowledge factor — something you know (password, PIN, secret answer).
Possession factor — something you have (token, security key, phone).
Inherence factor — something you are (fingerprint, face, voice).

Even an SMS OTP raises the cost of credential-stuffing dramatically: the attacker now needs to also intercept (or social-engineer) a code in real time, per account. Most stop trying.

Not all second factors are equal

OTPs delivered by SMS or app are vulnerable to phishing pages: the attacker shows a fake login, harvests password + OTP, and replays them within the OTP’s 30-second window. Hardware-bound factors — FIDO2 security keys, smart cards, biometric tokens — are phishing-resistant, because the cryptographic challenge is bound to the real origin. The phishing page can’t replay it to the genuine site.

What this means for you

If you are protecting an enterprise: your password-based auth has already been bypassed. The question is whether you know it yet. Layer on hardware-bound MFA — FIDO2 cards or USB keys — for any account that touches money, identity, or production access.

Related reading: Top 3 Benefits of MFA · Implementing FIDO2 (full developer guide) · OnePass Card (hardware authenticator).

Frequently asked questions

Is MFA still useful in 2026?

Yes — but the value is in the kind of MFA, not the count of factors. SMS-OTP and push are weakly phishing-resistant; WebAuthn-based hardware MFA (FIDO2 / passkeys) is genuinely phishing-resistant. If you are still on the former, the upgrade path is real and time-sensitive.

What does MFA protect against that a strong password does not?

A strong password fails as soon as it is captured by a phishing page, a key-logger, or a database breach. A second factor — especially a hardware-bound one — means an attacker who has the password still cannot complete the authentication ceremony. That is the threat class MFA closes.

Are all second factors equal?

No. SMS-OTP is vulnerable to SIM swap. Authenticator-app TOTP is vulnerable to phishing-page relay. Push notifications are vulnerable to push fatigue. Hardware-bound WebAuthn credentials are resistant to all of these classes: the credential is origin-bound, so there is nothing for the attacker to replay.

Which accounts should get the strongest factor first?

Administrative and recovery accounts, because they can re-grant everything else. Protecting user accounts while leaving the account that resets them on a weak factor inverts the priority.

Does MFA help if the password was already breached?

Yes — that is precisely the case it is designed for. A breached password alone no longer authenticates, which is why MFA is the single highest-value control against credential-stuffing.