A password alone is one guess, one leak or one phishing page away from being someone else’s. Multifactor authentication (MFA) adds a second proof, so a stolen password isn’t enough. It’s one of the most effective single steps you can take for an account, and it works unevenly. Some methods stop almost every mass attack, and others fail against the tricks attackers use most.
This page explains what MFA is, how much it helps, how the main methods compare, and what each can’t stop. It doesn’t recommend specific apps or keys. Choose the method for what you’re protecting, which threat modeling helps you judge.
What MFA is, in plain terms
Authentication means proving you’re you. There are three kinds of proof: something you know, such as a password, something you have, such as a phone or a security key, and something you are, such as a fingerprint. MFA asks for proof from at least two different kinds. A password plus a code from your phone is MFA. A password plus a second password isn’t, because both are things you know.
You’ll also see “two-factor authentication” (2FA) and “two-step verification.” They mostly describe the same thing, a password plus one more check.
The idea is simple. A leaked password is useless to someone who also needs your phone. Most attacks on ordinary people start with a password that was stolen, reused or guessed, which common threats covers, so a second factor cuts off the most common route in.
How much it helps
Two large studies give the best numbers, with limits.
Microsoft researchers studied commercial accounts showing suspicious activity over several months in 2022. They found MFA reduced the risk of compromise by 99.22% across the population, and by 98.56% for accounts whose credentials had already leaked. They also found a dedicated authenticator app outperformed SMS codes, though both were far better than no MFA. These were work accounts on one provider’s platform, so the figures won’t transfer exactly to your personal accounts.
Google’s 2019 study with New York University and the University of California, San Diego looked at personal accounts. An SMS code sent to a recovery phone blocked all automated bots, 96% of bulk phishing attacks and 76% of targeted attacks. On-device prompts blocked 100%, 99% and 90%. No user who relied only on security keys fell victim to targeted phishing during the study.
The pattern is clear. Any second factor stops nearly all mass attacks, and the choice of method matters more as attackers get more determined.
The main methods and what each stops
The US cybersecurity agency CISA groups methods by how well they resist the attacks seen in the wild. Its guidance is written for organisations, but the ranking applies to you too.
| Method | Mass password attacks | Push bombing | Phishing | Main weakness |
|---|---|---|---|---|
| Text message or voice code | Stopped | Not applicable | Vulnerable | SIM swaps, phishing and interception |
| Email code | Stopped if the inbox is protected | Not applicable | Vulnerable | Only as safe as the email account |
| Push prompt without number matching | Stopped | Vulnerable | Vulnerable | Approving by accident or out of annoyance |
| Push prompt with number matching | Stopped | Resistant | Vulnerable | Phishing |
| Authenticator app code (TOTP) | Stopped | Resistant | Vulnerable | Phishing; losing the device |
| Security key or passkey (FIDO/WebAuthn) | Stopped | Resistant | Resistant | Cost, support and recovery planning |
Email-code ratings are our reading. CISA’s published ranking covers the other rows.
Text message and voice codes
These send a one-time code to your phone number. They’re the easiest to set up and the weakest common option. CISA’s fact sheet says SMS and voice codes are vulnerable to phishing, to weaknesses in the phone network and to SIM swaps, and says they should be a last resort. NIST, the US standards body, classes SMS-based verification as a “restricted” authenticator, which is permitted but with the risk accepted knowingly. A SIM swap, where a scammer persuades your provider to move your number to their SIM, sends your codes to them. Common threats explains how it works.
That doesn’t make text codes useless. Google’s figures above show they stop most automated attacks. They’re a large step up from nothing, and a poor choice for accounts that really matter.
Push prompts
An app on your phone asks you to approve or deny a sign-in. It’s convenient, and it has a known weakness. In push bombing, also called MFA fatigue, an attacker who already has your password keeps triggering prompts until you approve one. CISA describes it as bombarding a user until they approve by accident or out of annoyance.
The 2022 breach of Uber is the best-known case. According to reports, an attacker bought a contractor’s credentials, sent a stream of push requests and then messaged the contractor on WhatsApp posing as IT, saying the requests would stop if one was approved. The contractor approved one. CISA recommends number matching, where you must type a number shown on the login screen into the app, which blocks blind approval.
Authenticator app codes
An authenticator app shows a six-digit code that changes about every 30 seconds. This is the Time-based One-Time Password (TOTP) method, defined in an internet standard called RFC 6238. When you set it up, usually by scanning a QR code, the service and your app share a secret. After that, both calculate the same code from the secret and the current time, so the code works even without a connection.
TOTP resists push bombing and SIM swaps, since the code never travels over the phone network. Its weakness is that you type the code into a page, and a fake page can capture it and use it immediately. CISA lists app-based one-time codes as resistant to push bombing but still vulnerable to phishing.
Security keys and passkeys
These use the FIDO and WebAuthn standards, which rely on public-key cryptography. Your device or security key holds a private key, and the service holds only the matching public key. Each credential is unique to one service. There’s no shared secret to steal, and the login is tied to the real website’s address. A fake site can’t use it, and that’s why CISA calls FIDO/WebAuthn the only widely available phishing-resistant method.
A security key is a small physical device you plug in or tap. A passkey is the same technology stored on your phone or computer, often synced across your devices. The FIDO Alliance says passkeys can replace older password-plus-code flows, and NIST’s 2025 guidance recognises syncable passkeys as multi-factor. Account creation covers passkeys when you sign up.
The trade-offs are cost, uneven support across services and the need to plan for losing the device.
What MFA doesn’t stop
MFA isn’t a force field. Know its limits.
- Phishing for the code. A convincing fake site can collect your password and your code and pass them to the real site in real time. Only phishing-resistant methods stop this.
- Pressure and trickery. Push bombing and calls from “support” ask you to approve something. Deny any prompt you didn’t start, and never read a code to a caller.
- Phone number takeover. A SIM swap defeats text codes and also lets an attacker reach accounts that use your number for recovery.
- Weak recovery routes. If an attacker can reset your password through an unprotected email account or a helpdesk, the second factor may not come into it. Protect your email with MFA first.
Getting locked out
Stronger MFA raises the cost of losing the device. This part of our advice isn’t sourced from a study, but it follows from how the methods work.
- Register a backup. Add a second security key or a second authenticator device before you need it.
- Save recovery codes. Many services give you one-time codes when you turn on MFA. Store them offline, not in the same place as your passwords.
- Know where your authenticator’s secrets live. If your authenticator app doesn’t back up or sync, a lost phone can lock you out of every account on it.
- Check what else can sign you in. An account is only as strong as the weakest method still enabled. If you use a security key but leave text codes switched on, an attacker may use the text codes instead.
Where to start
These steps run from most to least useful.
- Turn on MFA for your email first, then your password manager and your bank. Email resets everything else.
- Use the strongest method each service offers. In rough order that’s a security key or passkey, then an authenticator app or number-matching push, then text codes.
- If you use push prompts, turn on number matching if it’s available, and deny any prompt you didn’t start.
- Set up a backup method and save recovery codes offline before you rely on any of this.
- Where a strong method is available, switch off weaker ones for that account so they can’t be used as a way around it.
How far to go depends on what an account protects. A throwaway forum account doesn’t need a security key. Your email might. Introduction to passwords covers the first factor.
Sources
- Implementing Phishing-Resistant MFA, Cybersecurity and Infrastructure Security Agency, October 2022.
- CISA Discourages Use of App-Based, SMS and Voice MFAs and Encourages Phishing-Resistant MFAs, Bricker Graydon, 2022.
- Implementing Phishing-resistant MFA, CompliancePoint, 2022 (summarising the CISA fact sheet).
- Why you need phishing-resistant MFA, Route Fifty, 2022.
- How effective is multifactor authentication at deterring cyberattacks?, Microsoft Research (Meyer et al.), 2023.
- New research: How effective is basic account hygiene at preventing hijacking, Google Security Blog, 2019.
- What Is MFA Fatigue (Push Bombing)?, PowerDMARC, accessed October 2026 (reporting on the 2022 Uber breach).
- How Uber Was Breached Through MFA Fatigue, Centrex IT, accessed October 2026.
- What is TOTP?, Logto, accessed October 2026 (explaining RFC 6238).
- What is TOTP? A short guide for developers (RFC 6238 explained), Authgear, accessed October 2026.
- How FIDO works, FIDO Alliance, accessed October 2026.
- Passkeys, FIDO Alliance, accessed October 2026.
- SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management, National Institute of Standards and Technology, 2025.
- NIST 800-63 Article 22, Presencis, accessed October 2026 (summarising NIST’s treatment of SMS and syncable passkeys).
- FTC Issues Guidance On Protecting Against SIM Swap Attacks, BleepingComputer, reporting FTC guidance.