Accounts and protecting information

Multi-factor / two-factor authentication (MFA / 2FA)

A way to check at sign-in that it is really you, using two or more different kinds of evidence; with exactly two kinds it is called two-factor authentication (2FA). There are three kinds: something you know (a password or PIN), something you have (a phone, an IC card or a small device called a security key) and something you are (a fingerprint or your face). Typical examples: after the password, you enter a verification code sent to your phone by SMS or shown in an authenticator app, tap Approve on a notice on your phone, or use a passkey, which you unlock with your fingerprint, face or the phone's screen lock. A stolen password alone is then no longer enough to sign in. Some phishing sites, however, also ask for the code and use it at once; passkeys resist this kind of attack too. Two-step verification means checking in two steps; when both steps use the same kind of evidence, such as a password and a secret question, it is not multi-factor authentication.