multi-factor authentication (MFA)

basicwidespread

A login method where you verify your identity with at least two independent proofs – for example, your password and your phone or your fingerprint.

In plain terms

Imagine your apartment door has two different locks: one requires a key, the other a numeric code. If a burglar obtains your key, they remain outside without the code. Multi-factor authentication does the same for your accounts: a password alone is not enough to log in.

A 'factor' refers to the type of evidence. There are three basic types: something you know (password, PIN), something you have (phone, security key, bank card), and something you are (fingerprint, face). Security is strong because the two factors are of different types, so two passwords in a row do not count as multi-factor.

It became important because passwords leak en masse, and AI-written phishing emails in flawless Hungarian make it ever easier to trick people into giving them up. If your password falls into the wrong hands, the second factor can still stop the attacker.

In the age of AI agents, it also takes on a new role: if an agent handles affairs on your behalf, the second factor can be the point where you must personally approve a sensitive operation – such as a transfer.

How it works

You provide your username and password; this is the first factor the system verifies in the usual way.
The system requests a second proof of identity: it sends a notification to your phone, asks for a six-digit code from an app, or asks you to touch your security key.
The code is valid only briefly, typically for half to one minute, and is calculated from the exact time and a secret key known only to your phone and the provider, so knowing only your password is not enough to generate it.
The provider checks both proofs separately and grants access only if both are valid; in suspicious situations (new device, foreign country), it may request additional confirmation.
On devices deemed reliable, a second factor is requested less frequently so that daily use is not a burden.

An everyday example

You shop online and enter your bank card details, and then the banking app pops up on your phone: 'Do you approve the payment of 12,490 forints?' You confirm with your fingerprint, and only then does the purchase go through. The two factors here are your phone (something you have) and your fingerprint (something you are); the data printed on the card does not count as a factor on its own, as anyone can read it.

Who is affected

everyoneYour email account is also the key to your other accounts, because password-reset emails arrive there, so that is where it matters most to turn it on.

bank customer, investorIn the EU, it is mandatory for online banking logins and most online payments, so you encounter it daily. → Money

employeeMany workplaces now require it for corporate email and systems, and a hastily approved notification can put the entire company at risk. → Work & HR

developerIf you allow an agent access to your systems, you must decide which operations it can perform independently and which require human approval via a second factor. → Code

A common misconception

MythIf multi-factor authentication is enabled, my account can no longer be hacked.

In realityIt is much harder to crack, but not impossible: scammers can extract the code from you via phone or a fake website, or keep sending approval requests until you eventually click. You should never share the second factor with anyone, just as you would not share your password.

Limits and risks

The code sent via SMS is the weakest option because the message can be diverted and your phone number can be hijacked via SIM-swapping fraud; if possible, use an authenticator app or a security key.
If you lose or replace your phone and do not have a saved backup code, you can easily lock yourself out of your own account.
Phishing sites can relay your entered code to the real service provider in real time, so check which site you are on before typing the code.
AI-cloned audio and deepfake videos weaken audio- and face-based authentication and make a fraudster calling "on behalf of the bank" asking for your code more believable.

Similar, but not the same

two-factor authentication – Two consecutive steps are not necessarily two different types of evidence: a password and a security question are two steps, but both are 'something you know', so they count as only one factor.
password manager – A password manager stores and fills in strong, unique passwords for you, improving the first factor, but does not add a second one.
authorization management – Authentication decides who you are, while access control determines what you are allowed to do after logging in.

Related concepts

Broader

authentication, cybersecurity, identity and access management, zero trust

Narrower

two-factor authentication, one-time password, biometric identification, security key, strong customer authentication

On the edge

jelkulcs, phishing, password manager, deepfake, human approval

A brief history

The idea is older than the internet: at an ATM, the card and PIN code together already constitute two factors. In the EU, the strong customer authentication rules of the PSD2 directive have been required for most online banking and payment operations since September 14, 2019. For online card purchases, banks and merchants received a grace period, and in practice, it became widespread from the end of 2020 to the beginning of 2021.

Where things stand

At the end of 2026, it is a basic expectation, and in many places mandatory, at banks, major email and social services, and in workplace systems. Development is moving toward phishing-resistant solutions, above all passkeys, which also replace the password, and it is an open question how agents acting on your behalf will authenticate themselves.

Status: 2026 November

In the news

Appears in 1 Agent Age stories; the curve shows weekly occurrence in the news magazine.

Fake ChatGPT and Gemini pages used to steal advertising accounts and MFA codesOct 8, 2026 · Marketing

Also known as

MFA · 2FA · two-factor authentication · multi-factor authentication · multi-step authentication · multi-factor authentication · two-factor authentication · strong customer authentication

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.