What is MFA (Multi-Factor Authentication)?

Q: What is MFA (multi-factor authentication)?

Last updated: 7 November 2026 The short answerMulti-factor authentication (MFA) is a security check that asks for more than a password to sign in. You prove who you are with a second factor, such as a code from an authenticator app or an approval on your phone, so a stolen password alone is not enough to get into your account. 22%of breaches began with stolen credentials (Verizon DBIR 2025) How does MFA work? MFA combines two or more of these types of proof: Something you know: a password or PINSomething you have: your phone, an authenticator app or a security keySomething you are: a fingerprint or face scan Why does my business need MFA? Passwords are easily stolen, guessed or reused, and MFA significantly reduces the risk of unauthorised access, email compromise and ransomware attacks. It is also a core requirement of Cyber Essentials, and the rules on MFA became stricter from April 2026. Where should MFA be switched on? Start with email and Microsoft 365, then remote access, admin accounts and any cloud service that holds business or customer data. Read more: Why should my business use MFA?, the main benefits of MFA and what changed in Cyber Essentials from April 2026. Want MFA and account protection set up properly? Book a free 20-minute call.Talk to ABCOM Related answers and guidesWhat is MFA?Password manager or passkeys?What is ITDR?What is Zero Trust?All ABCOM FAQs Sources and further readingNCSC: Multi-factor authentication for online servicesVerizon: 2025 Data Breach Investigations Report

Last updated: 7 November 2026

The short answer

Multi-factor authentication (MFA) is a security check that asks for more than a password to sign in. You prove who you are with a second factor, such as a code from an authenticator app or an approval on your phone, so a stolen password alone is not enough to get into your account.

22%of breaches began with stolen credentials (Verizon DBIR 2025)

How does MFA work?

MFA combines two or more of these types of proof:

Something you know: a password or PIN
Something you have: your phone, an authenticator app or a security key
Something you are: a fingerprint or face scan

Why does my business need MFA?

Passwords are easily stolen, guessed or reused, and MFA significantly reduces the risk of unauthorised access, email compromise and ransomware attacks. It is also a core requirement of Cyber Essentials, and the rules on MFA became stricter from April 2026.